The vulnerability is a PHP Object Injection flaw caused by the deserialization of untrusted data supplied via the 'included' shortcode attribute in the JS Archive List plugin. An authenticated user with Contributor-level access can supply crafted input that yields a PHP object containing malicious properties. While the plugin itself does not provide a load-time execution vector, the presence of a separate plugin or theme that implements a PHP Object Retrieval (POP) chain would let the attacker delete or read files, or execute arbitrary code on the host.

The affected product is the WordPress plugin JS Archive List from the vendor skatox. All released versions up to and including 6.1.7 are vulnerable. No other impacted versions are listed.

The CVSS base score of 7.5 indicates high severity. The EPSS score of less than 1% suggests that exploitation is unlikely at this time, and the vulnerability is not currently in the CISA KEV catalog. Because the flaw requires authenticated access at the Contributor level, the attack surface is restricted to site administrators who have granted such permissions. An attacker would still need a complementary POP chain from another component to achieve remote code execution; otherwise, the impact remains limited to the flaws introduced by the vulnerability itself.