The Wonka Slide plugin for WordPress contains a stored cross‑site scripting flaw (CWE‑79) within its `list_class` shortcode. The plugin fails to properly sanitize or escape user‑supplied attributes, which allows attackers with contributor‑level access or higher to inject arbitrary JavaScript into the shortcode. When a visitor loads a page containing the malicious shortcode, the script runs in the victim’s browser and can hijack sessions, deface content, or execute additional malicious actions.

WordPress installations that host the Wonka Slide plugin from vendor mrlister1, specifically any version up to and including 1.3.3. The vulnerability applies to sites that permit contributors to create or edit the `list_class` shortcode, as the flaw is triggered by manipulating that shortcode’s attributes.

The base CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1 % suggests few detected exploitation attempts. The vulnerability is not listed in the CISA KEV catalog. Attackers must first be authenticated as contributors or higher, then use the plugin’s administrative interface to insert malicious attributes into the shortcode. Although the attack surface is restricted to privileged users, any compromise of contributor access can lead to session hijacking or defacement of the site.