The Fintelligence Calculator WordPress plugin is vulnerable to a stored cross‑site scripting flaw that can be triggered through the "fintelligence‑calculator" shortcode when an authenticated user supplies unfiltered attributes. Because the plugin does not sanitize or escape user input, an attacker with contributor‑level or higher access can embed arbitrary JavaScript in a page, causing it to execute whenever any user views that content. This weakness can lead to information disclosure, session hijacking, or malicious code execution on the victim’s browser, consistent with CWE‑79.

This issue affects ambitioncloud’s Fintelligence Calculator plugin for WordPress in all versions up to and including 1.0.3. Users who have installed these versions and have contributed content are potentially impacted.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low current exploitation probability, though this does not eliminate the risk. Because the flaw requires authenticated contributor access, attackers who can obtain such credentials (e.g., through credential compromise or social engineering) can inject malicious scripts that run in the browsers of all visitors to the affected pages. The vulnerability is not listed in CISA’s KEV catalog, yet the potential for widespread damage makes it a significant concern for sites that rely on this plugin.