The Shariff Wrapper plugin stores malicious scripts entered through the headline shortcode. Because the plugin uses a permissive custom sanitization routine followed by a str_replace that re‑injects HTML, event handlers can be added via a style attribute placeholder. A compromised page will run the attacker’s code whenever a site visitor loads the affected page, potentially leading to data theft, session hijacking, or defacement. This is a classic Stored XSS vulnerability (CWE‑79).

WordPress sites running Shariff Wrapper version 4.6.20 or earlier. The flaw is tied to the 3uu:Shariff Wrapper vendor and can be exploited by any authenticated user with Contributor level or higher. The payload is injected via the headline parameter in the [shariff] shortcode.

The public CVSS score of 6.4 places this flaw in the medium severity range. EPSS data is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating that exploitation is currently not widespread. Nonetheless, the attack requires only Contributor‑level access and the ability to edit or create a post containing the [shariff] shortcode. Once the payload is stored, the injected code executes automatically for all visitors to that post, giving the attacker a broad attack surface across the site’s user base.