The ThemeLoom Widgets plugin for WordPress stores configuration information for widgets in the database, and its los_showposts shortcode processes attributes without adequate sanitization or escaping. Because of this, an authenticated contributor or higher can inject arbitrary JavaScript into widget attributes. When a page containing that widget is rendered, the malicious code runs in every visitor’s browser, enabling client‑side attacks such as cookie theft or session hijacking. The flaw is a classic stored cross‑site scripting vulnerability (CWE‑79).

The affected product is the ThemeLoom Widgets plugin from livingOS, a WordPress plugin available in versions 1.8.5 and earlier. It runs on WordPress sites that have installed the plugin. Sites that rely on the los_showposts shortcode for displaying posts or content are vulnerable.

The CVSS 3.1 base score is 6.4, indicating a moderate severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. Attackers need only contributor-level access or higher within the WordPress site to exploit the flaw, making authenticated users the likely vector. The stored nature of the payload means that once injected, the malicious script persists until the widget configuration is removed or the site is patched.