The Temporarily Hidden Content plugin for WordPress contains a stored cross‑site scripting vulnerability in its temphc‑start shortcode. Because the plugin does not properly sanitize or escape user‑supplied attributes, an attacker who can log into the site with contributor level or higher can inject malicious JavaScript that is stored in the post content. When any user, including administrators, opens the page, the injected script runs in their browser, potentially stealing credentials, defacing content, or hijacking sessions.

This flaw affects the WordPress plugin Temporarily Hidden Content developed by codents, in all releases up to and including version 1.0.6. No other vendors are listed, and the advisory does not specify additional impacted components.

The CVSS score of 6.4 reflects a moderate risk, while the EPSS of less than 1 % indicates a low but non‑zero chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must possess contributor‑level or higher privileges to abuse the weakness, typically by inserting dangerous attributes into the temphc‑start shortcode. The stored payload then executes in any browser that loads the affected page, making the threat both persistent and widely visible among site users.