The BuddyHolis ListSearch plugin for WordPress allows an attacker who can authenticate to the site with a contributor or higher role to inject arbitrary JavaScript through the placeholder attribute of the listsearch shortcode. This stored XSS flaw means that any user viewing a page that contains the injected shortcode will execute the malicious script, potentially compromising user credentials, session information, or allowing further attacks on the affected WordPress installation. The vulnerability stems directly from insufficient input validation and inadequate output escaping, as identified by CWE‑79, and represents a moderate severity flaw with a CVSS score of 6.4.

All builds of BuddyHolis ListSearch up to and including version 1.1 are impacted; the plugin is distributed under the digiblogger:BuddyHolis ListSearch package. Any WordPress installation that has this plugin active and one of the affected releases installed is vulnerable, regardless of the WordPress core version.

The attack requires prior authentication to the site with contributor-level access or higher, which is often granted to content editors or developers. With this prerequisite satisfied, an attacker can place a crafted placeholder attribute that contains malicious JavaScript. The exploit is straightforward once the role is obtained, as the plugin stores the attribute value in the database without sanitization. The probability of exploitation, according to EPSS, is below 1%, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, the moderate CVSS score and potential for widespread user impact recommend treating this flaw with high priority.