The Orbisius Random Name Generator plugin for WordPress allows authenticated users with Contributor level or higher to inject arbitrary JavaScript through the 'btn_label' attribute of the 'orbisius_random_name_generator' shortcode. By omitting proper input sanitization and output escaping, malicious code is stored in the database and executed whenever a page containing the shortcode is rendered, enabling attackers to compromise the browsing context of any site visitor.

All installations of the Orbisius Random Name Generator plugin, versions up to and including 1.0.2, regardless of WordPress version. The vulnerability is present in all affected releases, so any site still running 1.0.2 or older is at risk.

The plugin scores 6.4 on the CVSS scale, indicating moderate severity. The EPSS score is reported as less than 1%, implying a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first be authenticated with Contributor or higher privileges, then craft a malicious 'btn_label' value; if successful, the stored script will execute for all users who view the page. This authenticated approach limits the threat surface to users who can access the shortcode editor, but once compromised it can be used to deface or steal user data.