The WP‑ShowHide plugin accepts user input that is stored and later rendered on the site without proper sanitization, enabling a stored XSS flaw. Based on the description, it is inferred that a malicious actor could inject JavaScript or other executable code that runs in browsers of any user who views the affected pages, potentially stealing session cookies, defacing content, or redirecting to phishing sites. This weakness is classified as CWE‑79.

WordPress sites that use the WP‑ShowHide plugin in any version up to and including 1.05 are affected. Vendors include Lester Chan. No later versions are listed as vulnerable, implying the issue was fixed after 1.05.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of <1% suggests a very low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the flaw is stored XSS, so the attack would require an attacker to supply and store a malicious payload through the plugin’s input interface; once stored, any user who views the affected content will be impacted. Attackers may target administrators or other privileged users to inject payloads, but general users can also be victims if the payload is embedded in public content.