The Infomaniak Connect for OpenID plugin for WordPress is vulnerable to stored cross‑site scripting through the endpoint_login attribute of the infomaniak_connect_generic_auth_url shortcode. Because the plugin does not properly sanitize or escape this parameter, an attacker who has Contributor or higher access can embed malicious scripts into a page that will run whenever any user views that page. This flaw can lead to session hijacking, defacement, or malicious redirection for users who view the affected content.

WordPress sites using the leopoldinfomaniak Infomaniak Connect for OpenID plugin, versions 1.0.2 and earlier. The vulnerability is present in all instances of these plugin releases regardless of additional configurations.

The CVSS score of 6.4 indicates a moderate severity assessment, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, so it is not currently known to be actively exploited. Attackers must be authenticated with Contributor‑level or higher permissions to add a malicious shortcode, and the malicious script will only execute when a user loads the affected page. Given the limited scope of required privileges and the low exploitation likelihood, the overall risk remains moderate while awaiting remediation.