The vulnerability resides in the Partnerský systém Martinus WordPress plugin, where the 'martinus' shortcode allows arbitrary script injection through user-supplied attributes. Because input is not properly sanitized and output is not escaped, an attacker with contributor-level or higher privileges can store malicious JavaScript that will execute whenever any visitor views the affected page. The impact is that an authenticated contributor can compromise the integrity of the website’s rendering process.

The flaw is present in all releases of the Partnerský systém Martinus plugin up to and including version 1.7.1. The affected application is the WordPress plugin hosted by the vendor maxomatos. System administrators should verify whether this plugin is installed on their sites and whether its version is 1.7.1 or older.

The CVSS score of 6.4 reflects moderate severity. The EPSS score of less than 1% indicates that, as of the latest data, the probability of exploitation is low. Moreover, the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been observed as a widely deployed exploit. The likely attack vector requires the attacker to be an authenticated contributor or higher, so the scope is limited to sites where contributor roles are granted. Once an attacker injects the payload, it is executed in the browsers of all visitors who load the compromised page.