The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress has a stored cross‑site scripting flaw caused by insufficient input sanitization and output escaping on the SQLREPORT shortcode attributes. Specifically, contributors or higher-level users can embed arbitrary web scripts into pages, and those scripts are executed when any authenticated or unauthenticated visitor loads the affected page. This allows attackers to run client‑side code in the context of a legitimate user, potentially leading to session hijacking, defacement or other malicious actions.

Scheeeli’s EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is affected in all releases up to and including version 5.25.11. Users running those or earlier versions should check the vendor’s plugin page for an updated release that fixes the vulnerability.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1%, reflecting a low projected exploitation probability in the general population. It is not listed in the CISA KEV catalog. Attackers must be authenticated with contributor-level or higher privileges to insert the malicious payload, after which the script will execute for any user who views the affected page.