The plugin’s shortcode fails to sanitize user‑supplied attributes, allowing an authenticated contributor to embed JavaScript that is stored and rendered on any page containing the shortcode. When other visitors load the page, the injected script executes in their browsers, potentially stealing session cookies, defacing content, or executing additional malicious payloads. This constitutes a stored cross‑site scripting vulnerability capable of affecting the confidentiality, integrity, and availability of user sessions.

All releases of the Mixtape WordPress plugin distributed by natata7 up to and including version 1.1 are affected. WordPress sites installing these plugin versions are potentially vulnerable; no further WordPress core version restrictions are noted.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The flaw requires Contributor or higher privileges, so it is primarily exploitable by compromised or malicious insiders or by users who collaborate with such insiders. Once injected, the stored script is delivered to every visitor of the affected page, allowing the attacker to indirectly impact other users. The vulnerability is not listed in the CISA KEV catalog, so no current known exploitation campaigns target it, but its impact is significant if an insider with sufficient privileges obtains it.