The Shortcoder WordPress plugin version 6.5.1 and earlier stores user input without proper neutralization, enabling stored cross‑site scripting (XSS). An attacker who can insert content through the plugin’s interface can embed malicious JavaScript that executes in the browsers of all visitors who load the affected page. This can lead to session hijacking, credential theft, defacement, or the delivery of malware, compromising the confidentiality and integrity of user sessions and data.

The vulnerability impacts the WordPress Shortcoder plugin packaged by the vendor vaakash. All releases up to and including version 6.5.1 are affected; no earlier or later versions are known to be vulnerable.

The CVSS base score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests rare exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers likely need administrative or editing access to inject malicious payloads, and the stored nature of the flaw implies that a single compromised content entry can affect all site visitors. Given the low exploitation probability, the risk to organizations that do not expose the plugin’s content editor to untrusted users is lower, but the potential impact warrants mitigation.