The OMIGO WordPress plugin has a stored cross‑site scripting vulnerability that allows an attacker with contributor‑level or higher privileges to inject arbitrary JavaScript via the `omigo_donate_button` shortcode. The plugin does not properly sanitize or escape user‑supplied attributes, meaning that malicious code can be stored and will execute whenever a page that includes the shortcode is viewed.

WordPress sites that have the OMIGO plugin installed with version 3.3 or earlier and that implement the `omigo_donate_button` shortcode in posts, pages, or widgets are affected.

The CVSS base score is 6.4, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with at least contributor privileges, so the attack vector is restricted to the site’s administrative user base. Once authenticated, the attacker can store malicious payloads that will run for every visitor who loads a page containing the shortcode.