An attacker with Contributor level or higher credentials can insert malicious JavaScript into the \u2018emailtext\u2019 attribute of the fusedesk_newcase shortcode. When a page containing this shortcode is viewed, the unsanitized script executes in the visitor’s browser, enabling session hijacking, data theft, or site defacement. The weakness is a classic example of CWE‑79, reflecting improper output filtering.

All WordPress installations that use the FuseDesk plugin from Jeremy Shapiro up to and including version 6.8 are affected. The vulnerability is present in every release of the plugin distributed through that version threshold, regardless of other plugins or themes.

With a CVSS score of 6.4 this vulnerability is considered medium‑high. The EPSS score is not available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, so exact exploitation likelihood is uncertain. The requirement for authenticated Contributor access means that sites with many contributors or with permissive role configurations are at higher risk. An attacker can create or edit a case to embed the malicious payload and then lure users to view that page, where the script runs with the visitor’s credentials.