The WP Random Button plugin stores user‑supplied shortcode attributes without proper escaping. An attacker with Contributor level or higher can embed malicious scripts in the 'cat', 'nocat', or 'text' attributes. When a page containing the malicious shortcode is viewed, the injected script runs in the visitor’s browser, giving the attacker the ability to steal session cookies, deface content, or perform further attacks. This is a classic stored XSS that can affect all users who view the compromised post or page.

WordPress sites that have the WP Random Button plugin version 1.0 or earlier installed. The plugin is provided by the vendor newbiesup. Any WordPress installation that uses this plugin is vulnerable unless it is updated to a newer, secure release.

The vulnerability receives a CVSS score of 6.4, indicating moderate severity. No EPSS score is published, and the issue is not listed in the CISA KEV catalog. Exploitation requires authenticated Contributor or higher privileges on the WordPress site. Once the attacker can edit posts or pages, they can insert the malicious shortcode. After insertion, any unauthenticated visitor who loads the affected page will execute the stored script, making the attack highly scalable once the payload is in place.