Columns by BestWebSoft’s Columns plugin allows an authenticated user with Contributor or higher privileges to embed arbitrary JavaScript into page output by manipulating the 'id' parameter of the [print_clmns] shortcode. Because the value is inserted directly into a div id attribute and inline CSS without escaping, any stored payload executes in the browser of every visitor that views the affected page. This yields a stored cross‑site scripting vulnerability that can compromise the account and data of all site users.

The flaw affects WordPress sites running any version of the Columns plugin up to and including 1.0.3. The vulnerability is present only when the plugin’s shortcode is used and at least one column has been created in the database, which an administrator creates during normal operation. Contributors who can edit or add posts that contain the shortcode can trigger the vulnerability.

The vulnerability carries a score of 6.4 and is not noted in the CISA Known Exploited Vulnerabilities catalog. No public exploit code is reported, and exploitation requires authenticated access with Contributor or higher privileges. Nonetheless, once a malicious script is stored it runs for every user who visits the impacted page, making it a moderate‑to‑high risk. Applying a vendor‑issued update or disabling the plugin should be treated as a high priority.