The vulnerability arises because the Codeless Page Builder plugin does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content. This omission allows users with contributor-level access and above to store malicious payloads containing arbitrary HTML and JavaScript. When a higher‑privileged user views the content, the injected code executes within that user's session, facilitating session hijacking, credential theft, or site defacement. The flaw is a classic stored cross‑site scripting (XSS) condition, giving the attacker persistent visibility into privileged sessions.

The affected product is the Codeless Page Builder WordPress plugin, versions 1.1.4 and earlier. All WordPress sites that have installed this plugin and have users with contributor or higher privileges are susceptible.

Although the EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, the impact is potentially severe due to the ability to run arbitrary code inside an administrator's session. The attack vector is content creation by contributors; exploitation requires a user with contributor rights to create or edit a post that includes the crafted shortcode. Once stored, any administrator or higher user who views that content will be impacted. The CVSS score of 5.4 indicates a medium severity.