The Scoreboard for HTML5 Games Lite plugin for WordPress stores the result of its shortcode directly in post content. The shortcode handler accepts arbitrary HTML attributes on the rendered iframe element, and only a limited blacklist is applied. Escaping functions do not neutralise attribute names that trigger JavaScript events such as onfocus or onmouseover. Consequently an attacker who can edit a post can inject script payloads that execute whenever any visitor views the page, providing typical XSS capabilities such as session theft or defacement.

All installations of the Scoreboard for HTML5 Games Lite plugin by demonisblack running WordPress, for every version up to and including 1.2. The vulnerability exists in the plugin code that generates the iframe element, regardless of the underlying WordPress version.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. Exploitation requires authenticated access at the Contributor level or higher, but no additional privileges are needed beyond the ability to edit post content. The lack of EPSS data and absence from the KEV catalog suggests that while the vulnerability is known, the current probability of exploitation is uncertain. Given that the payload runs client-side on all page viewers, the risk to sites with contributors is significant, especially if they host sensitive content or logged-in users.