The Wilmer Core plugin for WordPress is vulnerable to stored cross‑site scripting via shortcodes in versions up to and including 2.4.5. The flaw arises because attributes supplied by users in shortcode tags are neither sanitized nor escaped before being stored, allowing an authenticated attacker with contributor‑level or higher permissions to embed arbitrary JavaScript that will be executed when another user views the page containing the malicious shortcode.

Mikado Themes:Wilmer Core. All releases through version 2.4.5 are affected. No other vendors or product versions are listed as impacted.

The CVSS score for this vulnerability is 6.4, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at this time, although the flaw remains publicly available. The issue is not listed in the CISA KEV catalog. The attack requires that the attacker has authenticated contributor‑level (or higher) access to the site, and once the malicious code is stored it runs for any visitor to the compromised page.