The Switch CTA Box plugin contains a stored cross‑site scripting vulnerability in all releases up to and including 1.1. Insufficient sanitization of user‑supplied post meta such as link, button ID, text, and description allows an attacker to inject arbitrary JavaScript that will run for any visitor to a page containing the shortcode. The flaw is scoped to authenticated users with contributor or higher privileges, meaning sites with many contributors are at risk.

WordPress sites running the Switch CTA Box plugin version 1.1 or earlier. The vulnerability appears in the plugin’s active shortcode implementation, which displays content on post pages identified by a supplied post ID.

The CVSS score of 6.4 categorises this as a medium‑severity flaw. The EPSS score is not available, but the lack of listing in CISA’s KEV catalog suggests no widespread public exploitation is yet documented. Exploitation requires credentials with contributor access and involves injecting script payloads into the plugin’s shortcode output. Once injected, the payload executes in the context of any site visitor, potentially allowing defacement, cookie theft, or other client‑side attacks.