The flaw permits an authenticated user with contributor or higher privileges to insert arbitrary scripts via the ‘post_type’ attribute in the ‘swiftpost‑list’ shortcode. Because the plugin sanitizes and escapes this attribute incorrectly, the injected code is stored and later rendered in browsers of any visitor to the affected page, enabling phishing, credential theft, or other malicious activity.

The Show Posts list – Easy designs, filters and more plugin by creativedev4 is affected in all releases up to and including 1.1.0. Users with contributor-level or higher access can exploit the shortcode to inject the payload.

The CVSS score of 6.4 marks this issue as moderate severity. No EPSS entry and absence from the CISA KEV catalog suggest that exploitation has not been widely observed yet, but the stored nature of the XSS means every page view by an ordinary user triggers the malicious code. Attackers must first authenticate with at least contributor rights, limiting but not eliminating the threat. Once a valid injected payload is present, it can execute in the browser context of all visitors to the compromised content.