The iVysilani Shortcode plugin stores user input from the 'width' shortcode attribute without proper sanitization or escaping. As a result, authenticated users with Contributor‑level access can inject arbitrary scripts into the site. When those scripts are rendered by other users, they execute in the victim’s browser, enabling malicious actions such as stolen tokens or defacement.

All WordPress installations that have the iVysilani Shortcode plugin (developed by deckercz) installed in any version up to and including 3.0 are affected. The plugin is distributed through the WordPress Plugin Directory and adds shortcodes for custom content embedding.

The CVSS score of 6.4 indicates medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attackers require a Contributor‑level role, making the attack vector authenticated. Once a contributor injects malicious code, every site visitor who views the affected page will execute the script in their browser, posing a widespread risk within the site’s user base.