The Inline Stock Quotes WordPress plugin allows authenticated users with contributor level or higher to create or edit posts containing a stock shortcode. Due to insufficient sanitization and output escaping of shortcode attributes, an attacker can insert arbitrary JavaScript into the attribute value. When a page containing that shortcode is viewed, the injected script executes in the victim’s browser, permitting the attacker to steal session cookies, deface content, or deliver further malicious payloads. The vulnerability is a classic Stored Cross‑Site Scripting flaw, catalogued as CWE‑79.

All installations of ebernstein\u2019s Inline Stock Quotes plugin up to and including version 0.2. The vulnerability requires the user to have at least contributor privileges in the WordPress instance, but grants the same potential damage to any user who views a page that contains the injected shortcode.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate contributor account or higher, so the attack vector is limited to authenticated users who have write access to posts or pages. If such an account is compromised or mistrusted, the attacker can embed malicious scripts that will run for every subsequent viewer of the affected content, leading to widespread client‑side compromise.