The Prismatic WordPress plugin is vulnerable because the prismatic_decode function does not properly sanitize or escape user‑supplied attributes. As a result, an unauthenticated attacker can embed arbitrary JavaScript code within a comment that includes the malformed pseudo‑shortcode prismatic_encoded. The injected script is stored in the comment and executed whenever any user views the page containing that comment, leading to potential session hijacking, credential theft, or defacement.

It affects the Prismatic plugin for WordPress from the vendor specialk, in all released versions up to and including 3.7.3. No specific sub‑versions are listed beyond that upper bound.

The vulnerability carries a CVSS score of 7.2, indicating a high impact. Attackers do not need any credentials; a public comment submission suffices to inject malicious code. The EPSS score is not available, and the issue is not in the CISA KEV catalog, but the lack of user authentication requirements and the stored nature of the XSS suggest it could be readily exploited by an automated script once a comment is posted. The vulnerability is not mitigated by existing access controls and could be used to compromise any visitor to the affected WordPress site.