The ITERAS WordPress plugin contains a stored cross‑site scripting flaw that allows an authenticated user with Contributor or higher privileges to inject JavaScript into web pages. The vulnerability resides in the combine_attributes() method, which concatenates shortcode attribute values directly into a JavaScript object inside a <script> tag without proper escaping. By inserting a double‑quote into a shortcode attribute, an attacker can break out of the string context and inject arbitrary script that will run whenever a page containing the malicious shortcode is rendered.

WordPress sites using the ITERAS plugin version 1.8.2 or earlier are affected. The plugin is identified as iteras:ITERAS by the CNA and can be found under all releases up to and including 1.8.2.

The CVSS v3 score of 6.4 classifies this vulnerability as medium severity. The EPSS probability is reported as < 1 %, indicating a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires the attacker to be able to authenticate to the WordPress installation with at least Contributor permissions, which is a non‑trivial but realistic prerequisite for users who contribute content. Once an attacker injects malicious script, any visitor who views the affected page will execute the script in their browser, enabling cookie theft, session hijacking, or delivery of additional malware.