The vulnerability resides in the Outgrow WordPress plugin and allows an attacker who has at least contributor privileges to inject malicious JavaScript into the 'id' attribute of the 'outgrow' shortcode. Because the plugin fails to sanitize and escape this input, the script is stored in the database and executed whenever a user views a page that contains the shortcode. This stored cross‑site scripting can lead to session hijacking, defacement, or delivery of malware to site visitors.

Any WordPress installation that uses the Outgrow plugin in a version 2.1 or earlier is affected. The plugin is named 'Outgrow' and is distributed under the 'outgrow:Outgrow' vendor/package. All users who have contributor or higher roles on the site are at risk. Older WordPress sites or environments that still run these legacy plugin versions should consider them vulnerable.

The vulnerability carries a CVSS base score of 6.4, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers need authenticated access with contributor-level rights, which limits the potential attackers to site administrators or trusted contributors. Nevertheless, once the malicious payload is injected it affects all visitors to the affected pages, providing a high impact vector. Organizers should treat the risk as moderate but actionable.