The ER Swiffy Insert plugin for WordPress contains a stored XSS flaw triggered by the [swiffy] shortcode. User‑supplied attributes ("n", "w", "h") are extracted with extract() and interpolated directly into the HTML output without escaping, allowing an authenticated contributor or higher user to inject arbitrary JavaScript that will execute whenever a page containing the shortcode is accessed by any visitor.

The vulnerability affects the ER Swiffy Insert plugin from erithq, all versions up to and including 1.0.0.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score is not available, with no listing in the CISA KEV catalog. Exploitation requires a Contributor‑level account or higher; the attacker injects malicious code via the shortcode, which is stored in the database and rendered on any page that includes it, enabling client‑side execution for all visitors.