The vulnerability resides in the Orange Confort+ accessibility toolbar plugin for WordPress, where the "style" attribute of the ocplus_button shortcode is not properly sanitized or escaped. Authenticated users with Contributor level or higher can embed arbitrary JavaScript in this attribute. When the malicious shortcode is stored in a post, page, or widget, any visitor who views that content will have the injected script executed in their browser. This can result in session hijacking, request forgery, or defacement.

All versions of the plugin, up to and including 0.7, are affected. The vendor responsible is ravanh, and the product is the Orange Confort+ accessibility toolbar add‑on for WordPress. Sites that have installed these versions and allow contributors or higher to edit content are exposed.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not included in the CISA KEV list. An attacker needs to compromise a WordPress account with sufficient privileges and inject the malicious shortcode into stored content. Once deployed, the attacker can compromise the browsing session of any user who loads the affected page.