The WP Shortcodes Plugin — Shortcodes Ultimate is affected by a Stored Cross‑Site Scripting flaw (CWE‑79) that arises from insufficient input sanitization and output escaping on user‑supplied shortcode attributes. An attacker with contributor‑level or higher WordPress permissions can embed arbitrary scripts that are stored and subsequently rendered when any site visitor accesses a page containing the injected shortcode. This issue permits malicious code execution in the context of the site, enabling credential theft, session hijacking or site defacement.

The vulnerability impacts the WP Shortcodes Plugin — Shortcodes Ultimate developed by gn_themes. All installed versions up to and including 7.4.2 are affected; newer releases are presumed patched. The flaw persists across all WordPress sites that rely on this plugin and have contributors with editing privileges.

The CVSS score of 6.4 indicates moderate severity, while the EPSS of less than 1% suggests a low probability of exploitation. Because the flaw requires authenticated access at contributor level or higher, the effective attack surface is limited to sites where such roles exist. The attack is relatively straightforward: an attacker creates or edits a post or page, inserts a malicious shortcode that injects script, and then any visitor triggers execution. Though the likelihood is low, the potential damage—such as credential theft or defacement—makes it a significant concern for sites with high‑traffic user bases.