The Earnware Connect plugin for WordPress allows authenticated users with contributor role or higher to embed arbitrary scripts through its 'ew_hasrole' shortcode. Because the plugin fails to properly sanitize and escape user‑supplied shortcode attributes, a stored cross‑site scripting flaw exists. Any visitor who loads a page containing the malicious shortcode will execute the injected script, potentially hijacking sessions, phishing, defacing the site or otherwise compromising confidentiality and integrity.

Vulnerable systems are WordPress installations that have the Earnware Connect plugin installed in versions 1.0.74 or earlier. The bug is present in all releases up to and including 1.0.74; newer releases are not documented as affected and are assumed to contain the fix.

The CVSS score of 6.4 classifies the issue as moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog, and because it requires authenticated contributors to inject the payload, the attacker pool is limited. Nonetheless, once injected, the script executes for every page view, making the potential impact significant if the plugin remains unpatched or the shortcode is not removed.