The Optio Dentistry plugin for WordPress is vulnerable to stored cross‑site scripting (CWE-79) due to insufficient sanitization and escaping of user‑supplied attributes in its ‘optio‑lightbox’ shortcode. An attacker exploiting this flaw can inject arbitrary JavaScript that executes in visitors’ browsers when they view pages containing the injected shortcode, compromising confidentiality, integrity and availability of site contents for all users.

All WordPress sites running the Optio Dentistry plugin version 2.2 or earlier are impacted. The flaw is inherent in the plugin’s shortcode handling and is not tied to a specific WordPress core version. Administrators should verify the plugin version installed and audit sites that used the shortcode.

This vulnerability, classified as CWE-79, has a CVSS score of 6.4 indicating moderate‑high severity, while an EPSS score of less than 1% suggests a very low likelihood of real‑world exploitation at the time of analysis. The flaw is not recorded in CISA’s KEV catalog. Exploit requires authenticated contributor‑level or higher access, permitting injection of malicious scripts that persist across page reloads. Successful exploitation would allow attackers to hijack user sessions, steal credentials or inject further malicious payloads.