The CodeColorer plugin for WordPress is vulnerable to a stored cross‑site scripting flaw caused by inadequate input sanitization and output escaping of the 'class' parameter in the 'cc' comment shortcode. An unauthenticated attacker can inject arbitrary JavaScript into a comment, which is stored in the database and delivered to any visitor who views the comment. The injected script runs in the context of the site and can be used to hijack user sessions, deface the site, or perform other malicious client‑side actions. The weakness is classified as CWE‑79.

WordPress sites using the CodeColorer plugin version 0.10.1 or earlier are affected. The vulnerability applies to installations where comments are enabled on the target post and guest comments are permitted. The product is identified as kpumuk:CodeColorer.

The vulnerability scores 6.1 on the CVSS scale, indicating a medium severity risk. EPSS is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is web‑based and requires unauthenticated access to the comment interface; successful exploitation could impact all users who view the compromised page.