The ShortcodeHub WordPress plugin accepts an author_link_target parameter that is not properly sanitized or escaped. When a user with Contributor privileges or higher updates a shortcode containing this parameter, malicious JavaScript can be stored in the site database. Whenever another visitor views the affected page, the stored script is rendered and executed in the visitor’s browser. The resulting persistent cross‑site scripting allows the attacker to run arbitrary client‑side code whenever the page is accessed, potentially revealing sensitive information or enabling session hijacking; however, this specific misuse is inferred from the nature of the flaw and not explicitly stated in the description.

This issue impacts all versions of the ShortcodeHub – MultiPurpose Shortcode Builder plugin produced by surror that are 1.7.1 or earlier. The plugin is distributed as a standard WordPress plugin and is commonly used on sites that require advanced shortcode functionality.

The CVSS score of 6.4 classifies the vulnerability as moderate severity, while the EPSS score of less than 1% indicates a very low probability of real‑world exploitation at present. The flaw requires authenticated access with Contributor level or higher, so the attack vector is most likely an insider or a compromised user account rather than an unauthenticated attacker. The vulnerability is not listed in the CISA KEV catalog, further reducing the perceived urgency.