The Essential Widgets plugin for WordPress suffers from a stored cross‑site scripting flaw that allows authenticated contributors or higher to inject arbitrary JavaScript into the HTML output of pages that use the plugin’s shortcode attributes. Because the plugin fails to sanitize or escape user‑supplied shortcode parameters, an attacker can place malicious payloads that will execute in the browsers of any visitor who loads the affected page. This can lead to session hijacking, cookie theft, or the execution of further malicious actions posing a threat to confidentiality and integrity of user accounts.

The vulnerability affects all releases of the Essential Widgets plugin up to and including version 3.0. The plugin is developed by Catch Themes and is widely used in WordPress sites that rely on shortcodes such as ew-author, ew-archive, ew-category, ew-page, and ew-menu.

The flaw receives a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low probability of current exploitation. It is not listed in the CISA KEV catalog, so no known active exploits are documented. Attackers must be authenticated with contributor-level access or higher and must know the shortcode format to inject payloads. The attack vector is through normal use of the plugin’s shortcodes within the WordPress editor or similar interfaces, making it an insider‑or‑trusted‑user threat scenario.