The Investi WordPress plugin fails to sanitize the maximum‑num‑years attribute of its investi‑announcements‑accordion shortcode, allowing an authenticated Contributor or higher user to embed arbitrary JavaScript. The inserted script is stored in the database and delivered to any visitor who views a page containing the shortcode, potentially stealing credentials, defacing content, or performing further malicious actions on behalf of the user. This flaw corresponds to CWE‑79, a classic stored XSS weakness.

Any WordPress site that installs the Investi plugin version 1.0.26 or earlier is affected. The vulnerability is present in all releases through 1.0.26, regardless of the WordPress core version.

The flaw carries a CVSS score of 6.4, indicating moderate severity. EPSS data is not published, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only Contributor‑level login, which is a common role on many sites. Once an attacker supplies a malicious maximum‑num‑years value, the payload is stored in the database and will execute for any user who loads the affected page, making the attack straightforward and low‑cost for an authenticated user.