The Consensus Embed plugin for WordPress has a stored cross‑site scripting flaw caused by insufficient sanitization and escaping of user‑supplied attributes in the consensus shortcode. This vulnerability falls under CWE‑79 and permits an attacker to embed malicious JavaScript that executes whenever a page containing the shortcode is accessed. The impact is the potential compromise of confidentiality, integrity, and availability of site content and users through arbitrary script execution.

WordPress sites running the Consensus Embed plugin from the ConsensusIntegrations vendor, specifically all releases up to and including version 1.6. The flaw exists in every version of the plugin up to that point and is triggered when the plugin renders the consensus shortcode on a page.

The CVSS v3 score of 6.4 indicates moderate severity. The exploitation probability, as measured by the EPSS score, is less than 1 %, suggesting that while the vulnerability exists, it is currently not widely targeted. The flaw requires an authenticated user with Contributor-level permissions or higher, implying a relatively limited attacker pool. The vulnerability is not listed in CISA’s KEV catalogue, so no active exploitation campaigns are documented. Given these factors, the risk is moderate but not negligible; without official remediation, a potential attacker could leverage it to compromise users who view affected pages.