The Uncode Core plugin for WordPress contains a stored cross‑site scripting vulnerability in its 'uncode_hl_text' and 'uncode_text_icon' shortcodes. Unsanitized user‑supplied attributes are rendered without escaping, allowing a contributor‑level attacker to embed arbitrary JavaScript that runs whenever anyone views the affected page. This can lead to session hijacking, defacement, or other malicious actions against site visitors.

All versions of the Uncode Core plugin up to and including 2.9.4.2 are affected. The product is provided by undsgn as the Uncode Core WordPress plugin.

The CVSS score of 6.4 indicates moderate severity, and the current EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability requires authenticated access with contributor or higher privileges; the attacker does not need to exploit a memory corruption or privilege escalation bug. Because it is not listed in the CISA KEV, there are no publicly known active exploits, but the data suggests that the issue is critical for sites that allow contributors. Site owners should treat this as a moderate risk that can be mitigated by patching.