The Ravelry Designs Widget plugin for WordPress is vulnerable to stored cross‑site scripting through the 'layout' attribute of the 'sb_ravelry_designs' shortcode. Insufficient input sanitization and output escaping allow an authenticated user with contributor level or higher to inject arbitrary JavaScript, which will run in the context of any visitor who loads the affected page. This could lead to cookie theft, session hijacking, defacement, or the execution of additional malicious payloads.

WordPress sites running the Ravelry Designs Widget plugin version 1.0.0 or earlier, provided by the shellbot vendor. All versions up to and including 1.0.0 are affected; no specific higher version was listed as fixed.

The CVSS score of 6.4 indicates medium severity. The EPSS score is under 1 %, suggesting a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Authenticated users with contributor-level access and higher can exploit the flaw; they must add the shortcode with a malicious 'layout' value to a page or post that is then viewed by other users.