The Ad Short WordPress plugin suffers from a stored cross‑site scripting flaw in the 'client' attribute of its ad shortcode. Shortcode attributes are captured through shortcode_atts() and directly inserted into the 'data-ad-client' HTML attribute without sanitization. Consequently, any contributor or higher level user who can edit posts or pages can inject arbitrary JavaScript that will be served to all visitors of the page. This flaw enables malicious code execution in the context of the site, potentially compromising user accounts, defacing content, or stealing credentials.

The vulnerability affects the Ad Short plugin, version 2.0.1 and earlier, for the WordPress content‑management system. Any WordPress installation that has this plugin installed and where users with Contributor privileges are allowed to edit content is potentially impacted.

The flaw carries a CVSS v3.1 base score of 6.4, indicating moderate risk. There is no EPSS score available, and the issue is not listed in the CISA Known Exploit Vulnerabilities catalog. Exploitation requires authenticated access with Contributor or higher permissions to insert malicious content via a post or page. Because the payload is stored, all subsequent visitors to that content will run the injected script, creating a wide‑reach attack surface once the content is published.