The isMobile WordPress plugin is vulnerable to stored cross‑site scripting because the ‘device’ parameter is not properly sanitized or escaped before being stored. An attacker with Contributor or higher access can embed arbitrary JavaScript into the plugin’s configuration, which will execute whenever a user views an affected page. The flaw enables credential theft, session hijacking, or other malicious client‑side actions, though the record only indicates potential use of XSS payloads.

WordPress sites running the isMobile() Shortcode plugin version 1.1.1 or earlier are affected. Only users with Contributor or greater permissions can write the malicious payload.

The CVSS score of 6.4 classifies the vulnerability as medium severity, while an EPSS of <1 % indicates very low likelihood of exploitation. The flaw is not listed in CISA KEV, implying no widespread attacks. An attacker must first obtain authenticated Contributor+ access to store the payload; after that, the stored XSS executes in the client’s browser.