The HTML Tag Shortcodes plugin for WordPress permits contributors to embed arbitrary attributes, and the plugin fails to sanitise or escape those attributes. Stored cross‑site scripting is therefore possible when a malicious contributor inserts a script payload into a shortcode that is then rendered for all visitors. This can lead to theft of session cookies, credential phishing, or malicious redirects. The flaw is a classic input validation weakness (CWE‑79).

WordPress sites that have the jhoylman HTML Tag Shortcodes plugin installed at version 1.1 or earlier. Any site where users with contributor or higher roles can create or edit content is susceptible. The vulnerability is present across all releases of the plugin up to and including 1.1.

The vulnerability is assigned a CVSS score of 6.4, indicating moderate severity. The EPSS score is below 1 %, signalling a very low probability of exploitation in the near term, and the issue does not appear in the CISA KEV catalog. Attackers must have contributor‑level access or higher to inject malicious content; once stored, the payload executes automatically for any user who views the affected post. The lack of input sanitisation makes exploitation straightforward for an authenticated user, but the low EPSS suggests active exploitation campaigns are unlikely at present.