The Sudoku Shortcode plugin contains a stored cross‑site scripting flaw in the ‘background’ attribute of the ‘sudoku‑sc’ shortcode, which is identified as CWE‑79. The attribute is not properly sanitized or escaped, allowing malicious script payloads to be preserved in the post content. Anyone who visits a page containing the injected shortcode will have the script executed in their browser, potentially leading to session hijacking, defacement, or the delivery of deceptive content.

WordPress sites running the Sudoku Shortcode plugin from tibouille, at version 1.0.0 or earlier, are affected. Administrators should verify the installed version and apply any official update. Users with at least Contributor privileges can inject code via the shortcode; unauthenticated users cannot directly exploit the flaw.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of < 1% indicates a very low probability of exploitation. It is not listed in the CISA KEV catalog, implying no known widespread exploitation. Based on the description, it is inferred that the attack requires authenticated access with at least Contributor privileges, and the vulnerability is stored, meaning once injected it serves to all subsequent viewers of the page. The lack of sanitizer makes exploitation straightforward for an attacker with write permissions.