The List category posts plugin for WordPress contains a flaw in its "catlist" shortcode. The plugin accepts user-supplied attributes and stores them without proper sanitization or output escaping. An attacker who is logged in with contributor-level or higher privileges can inject malicious JavaScript into these attributes. When any site visitor loads a page that contains the compromised shortcode, the script runs in the visitor’s browser, exposing the site to data theft, defacement, or redirection.

WordPress installations that use the List category posts plugin version 0.94.0 or earlier are affected. The vulnerability exists in all releases up to and including 0.94.0, while later versions have removed the problematic logic. Sites must also have users with contributor or higher roles able to use the "catlist" shortcode.

The vulnerability has a CVSS base score of 6.4, which is considered medium severity. Exploit probability is not quantified in the available EPSS data, and the flaw is not listed in the CISA KEV catalog, suggesting limited observed exploitation. The attacker must have authenticated access with at least contributor privileges; however, once such access is achieved, the injected script can affect all site visitors who view the modified page.