The Ruven Themes: Shortcodes plugin is vulnerable to stored cross‑site scripting through its ‘ruven_button’ shortcode. Unsanitized input attributes allow an authenticated contributor or higher to embed malicious scripts, which will then execute in the browsers of any user who visits a page containing the injected shortcode. This flaw can compromise the confidentiality and integrity of user data by enabling unauthorized script execution, and it can also be used to deface or hijack the site’s user interface.

WordPress sites installing the Ruven Themes: Shortcodes plugin, versions 1.0 and earlier, are affected. The vulnerability exists in the default installation delivered by the plugin author "ruven-themes."

The CVSS score of 6.4 indicates a moderate‑to‑high risk. An EPSS score of less than 1% suggests that, at present, exploitation is unlikely but not impossible, especially in targeted environments. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to have contributor‑level access on the site or higher and to insert a malicious shortcode into a post or page. Once site visitors load the affected content, the injected script will run in their browsers.