The Administrative Shortcodes plugin for WordPress is vulnerable to stored cross‑site scripting in versions up to and including 0.3.4 because it fails to sanitize or escape the content of the 'login' and 'logout' shortcode attributes. This flaw allows any authenticated user with Contributor‑level access or higher to embed arbitrary JavaScript that is persisted in the page content and executed whenever the page is displayed to any visitor.

Any WordPress site that installs the shazdeh Administrative Shortcodes plugin version 0.3.4 or earlier is affected. All installations using these plugin releases, regardless of theme or other plugins, are susceptible to the stored XSS vulnerability.

The CVSS v3.1 score is 6.4, indicating a moderate severity level. The EPSS score is below 1 %, showing a low probability of exploitation in the recent period. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with Contributor‑level or higher permissions to embed malicious payloads, typically by editing a page or post that contains the vulnerable shortcodes. Once injected, the malicious script runs in the context of any user who views the affected page.