The Shortcodify plugin for WordPress versions 1.4.3 and earlier stores user‑supplied input from the 'name' shortcode attribute without proper sanitization or escaping, allowing an authenticated user with contributor or higher privileges to embed arbitrary JavaScript. Attackers can inject scripts that execute for any visitor to the affected page, exposing them to session hijacking, cookie theft, or malicious redirects. This flaw represents a classic stored XSS identified as CWE‑79. The vulnerability is introduced by insufficient input filtering and output escaping. Affected systems: Any WordPress installation running the Shortcodify plugin version 1.4.3 or earlier, regardless of the core WordPress version, and that has the plugin activated.

Any WordPress installation running the Shortcodify plugin version 1.4.3 or earlier, regardless of WordPress core version, provided the plugin is active.

The CVSS score of 5.0 indicates moderate severity, while the EPSS score of less than 1% implies a very low probability of widespread exploitation. The flaw requires authenticated access with contributor or higher permissions, so an attacker who compromises a legitimate user account or gains such access through social engineering can inject malicious scripts that run for every user who views the impacted content. The attack vector is therefore via the 'name' shortcode when an editor or author creates or edits a post containing Shortcodify. The vulnerability is not currently listed in the CISA KEV catalog.