The WP Circliful plugin for WordPress contains a stored XSS flaw in two shortcodes. The 'id' attribute of the [circliful] shortcode and the attributes of the [circliful_direct] shortcode are concatenated directly into HTML output without sanitization or escaping. This allows an authenticated user with Contributor‑level or higher privileges to inject arbitrary HTML or JavaScript that will execute whenever any visitor loads a page containing the shortcode. The vulnerability is a classic input‑validation weakness (CWE‑79).

All WordPress sites that have installed WP Circliful version 1.2 or earlier and that allow users with Contributor or higher roles to add or edit content with the [circliful] or [circliful_direct] shortcodes are affected. The plugin’s shortcode handling is present unchanged through version 1.2.

The CVSS base score is 6.4, indicating moderate severity. Exploitation requires authenticated access with Contributor or higher privileges, which limits the threat to sites with multiple trusted users. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack path is straightforward: an attacker crafts a malicious shortcode, publishes or edits a page, and the payload is stored and later rendered for all visitors, enabling session hijacking, credential theft, defacement, or malware delivery.