The Mikado Core plugin for WordPress contains a stored cross‑site scripting vulnerability that is triggered by maliciously crafted shortcodes. When a user with contributor or higher privileges submits content containing user‑supplied attributes that are not properly sanitized or escaped, the payload is saved into the page. Any visitor who loads the affected page will have the malicious script executed in their browser, allowing the attacker to steal information, hijack sessions, or deface the site. The weakness is a classic input validation error (CWE‑79).

All installations of Mikado Core version 1.5.2 or earlier are affected. The vulnerability applies to any WordPress site that uses this plugin and permits contributors or higher roles to insert or edit page content. No specific patch version is listed in the supplied data, so administrators should verify that the plugin has been updated beyond 1.5.2.

The CVSS score of 6.4 indicates a medium severity impact. The EPSS score of < 1% suggests that exploitation is unlikely but still possible, especially against sites with many users. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated user with contributor permissions, so any compromised contributor account can serve as a foothold to inject the payload. If an attacker controls such an account, the malicious script will run for all site visitors who view the affected page.