The Simple Bible Verse via Shortcode plugin for WordPress contains an input handling flaw in its `verse` shortcode. The plugin accepts arbitrary attribute values but does not properly sanitize or escape them before storing the data. This allows an attacker with contributor-level or higher permissions to embed malicious JavaScript into the attributes of a shortcode that is then rendered on any page that includes the verse. The flaw results in Stored Cross‑Site Scripting, enabling attackers to execute arbitrary code within the context of the site, potentially theft of cookies, session hijacking, defacement, or phishing.

Any WordPress installation that has the Simple Bible Verse via Shortcode plugin version 1.1 or earlier installed is affected. The vendor is dannycarlton. Sites using the plugin in versions up to and including 1.1 expose all users who view pages containing the verse shortcode to injected scripts.

The CVSS base score is 6.4, indicating moderate severity. The EPSS score is less than 1%, so large‑scale exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an authenticated user with contributor or higher privilege to create or edit a post that uses the verse shortcode with malicious attributes; once stored, any visitor to that page will be exposed to the injected script.