An authenticated user with Contributor or higher access can insert arbitrary JavaScript into the ‘title’ attribute of the ‘sherkcptdisplays’ shortcode. The plugin does not escape this value before placing it inside an <h2> tag, allowing stored cross‑site scripting that executes for every visitor who views a page containing the shortcode.

WordPress installations that have the Sherk Custom Post Type Displays plugin up to and including version 1.2.1 are affected. The vulnerability resides in the plugin’s handling of the 'title' attribute within shortcodes and does not depend on external services.

The vulnerability carries a CVSS score of 6.4 and is not listed in CISA’s KEV catalog. Because exploitation requires an authenticated Contributor or higher role, the likelihood of immediate public exploitation is lower, yet any compromised user could inject malicious scripts that persist across sessions and expose site visitors to cross‑site scripting attacks. The lack of an EPSS value means the probability of exploitation cannot be precisely quantified, but the moderate severity score indicates that the risk to compromised sites is significant.