The WP Blockade plugin for WordPress contains a reflected Cross-Site Scripting flaw in the 'shortcode' parameter handled by the render_shortcode_preview() function. The endpoint receives user input from $_GET['shortcode'], applies only stripslashes(), and then echoes do_shortcode($shortcode). If the supplied string is not a valid WordPress shortcode, do_shortcode() leaves it unchanged, resulting in the unsanitized input being rendered on the page. This allows an attacker to inject arbitrary HTML or JavaScript that will execute in the context of the page when a user visits the crafted URL.

Vulnerable versions are all releases of WP Blockade—Visual Page Builder version 0.9.14 and earlier, distributed by BurlingtonBytes. The endpoint is registered via admin_post_, requiring login but granting access to any authenticated user with at least Subscriber-level privileges. No nonce check or additional capability verification is performed.

The CVSS score of 6.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting a lower immediate threat but still exploitable. The likely attack vector involves an authenticated user clicking a crafted link that includes a malicious 'shortcode' value. Once injected, the script runs in the browser of any user who views the rendered page, potentially enabling session hijacking, defacement, or data exfiltration. The absence of a nonce and capability guard makes the flaw straightforward to exploit for any logged‑in user with Subscriber or higher access.