The Yoga Schedule Momoyoga WordPress plugin stores user‑supplied attributes from its ‘momoyoga‑schedule’ shortcode without proper sanitization or escaping, allowing authenticated attackers with contributor or higher permissions to inject arbitrary JavaScript. This stored cross‑site scripting flaw means that any visitor viewing a page containing the affected shortcode will automatically execute the malicious script, creating opportunities for credential theft, session hijacking, or site defacement.

WordPress installations that have the Momoyoga plugin version 2.9.0 or earlier are affected. Any such site that includes the vulnerable shortcode in posts or pages is susceptible to the flaw.

The CVSS score of 6.4 categorises the vulnerability as moderate severity, but the EPSS score below 1% indicates a low likelihood of current exploitation. The flaw is not listed in CISA's KEV catalog, further suggesting limited real‑world impact to date. Nevertheless, the attack only requires contributor‑level access, meaning that compromised credentials can readily be used to supply malicious shortcode attributes, making timely remediation advisable.