A stored cross‑site scripting vulnerability exists in the Ecover Builder For Dummies WordPress plugin. The plugin does not sanitize the "id" attribute of its shortcode, enabling attackers who can reach the plugin’s shortcode input (logged in with Contributor level or higher) to store malicious scripts. When a page containing the shortcode is viewed, the injected script runs in the browser context of all visitors, potentially stealing credentials, defacing content, or executing further attacks.

The flaw affects the WordPress plugin Ecover Builder For Dummies produced by Miguel Martinez Lopez. All released versions up to and including 1.0 are vulnerable; the problem is tied to the shortcode handler in that plugin. Sites that have installed or reside on any of these versions are at risk, regardless of the number of user accounts.

The CVSS score of 6.4 indicates moderate severity; the attack requires authenticated access at the Contributor level or higher and the exploitation is straightforward because the input is stored and then rendered without proper escaping. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a privileged user adding a malicious shortcode to a post or page that is then served to all site visitors. Because the issue is stored, a single successful injection can affect an entire site or multiple users.