An attacker with contributor or higher access can exploit a stored cross‑site scripting flaw in the Related Posts by Taxonomy WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of the 'related_posts_by_tax' shortcode attributes; arbitrary scripts can be stored in a post’s metadata. When a user views a page containing the malicious shortcode, the injected code runs in the context of that site, potentially hijacking sessions, defacing content, or executing further attacks.

The flaw affects the keesiemeijer: Related Posts by Taxonomy plugin installed on WordPress sites. All released versions up to and including 2.7.6 are vulnerable. Version 2.7.7 or later removes the vulnerability by properly sanitizing shortcode attributes.

The CVSS score of 6.4 indicates moderate severity, but the EPSS score of less than 1 % suggests low likelihood of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated contributor‑level account with the ability to edit or create posts that use the shortcode; no remote code execution or local privilege escalation is possible. If the vulnerable plugin is left in place, any authenticated user with the required role can inject malicious scripts that will affect all visitors to the page.