The Wueen plugin for WordPress allows a stored XSS attack through its wueen-blocket shortcode when users supply attributes without proper sanitization or escaping. An attacker who can create or edit content with contributor or higher privileges can inject arbitrary JavaScript that will run in the browsers of any site visitor who views the affected page, potentially exposing sensitive information, performing session hijacking, or defacing the site.

All installations of the nabeghe Wueen plugin released up to and including version 0.2.0 are affected. The vulnerability is present in any WordPress site using one of these versions of the plugin.

The CVSS score of 6.4 indicates a medium severity, while the EPSS score of less than 1% reflects a very low probability of attack at this time. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires authenticated contributor‑level access, only users with such permissions can exploit it. The impact is limited to unintended script execution on pages viewed by site visitors, but the potential for widespread damage makes timely remediation important.