The Taeggie Feed plugin for WordPress is vulnerable to stored cross‑site scripting because the plugin’s render() method directly inserts unescaped user‑supplied data into a <script> tag. The flaw resides in the taeggie‑feed shortcode; the name attribute supplied by the user is used as both an id attribute and a data argument to jQuery.getScript() without any escaping. As a result, an attacker who can supply a crafted name value can embed arbitrary JavaScript that will be saved in the plugin’s content and run whenever a page containing that shortcode is loaded.

This vulnerability affects all installations of the Taeggie Feed WordPress plugin with version 0.1.10 or earlier. Any site that has not upgraded beyond 0.1.10 may be compromised, regardless of other plugins or themes.

The CVSS score of 6.4 indicates moderate severity, while the EPSS of < 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be authenticated and have contributor‑level rights or higher; after injecting malicious JavaScript, any visitor to a page containing the taeggie‑feed shortcode will execute the payload in their browser context.