The vulnerability allows an attacker who has authenticated with Contributor or higher privileges to embed arbitrary scripts into the content of a WordPress page. The injection occurs through the 'id' attribute of the cihub_metadata shortcode, which is not sanitized and is output directly. Once injected, these scripts execute in the browser of any visitor who loads the affected page, leading to theft of session cookies, defacement, or further compromise of the site.

WordPress sites that have the CI HUB Connector plugin version 1.2.106 or earlier installed are affected. The issue was present in all releases up to and including 1.2.106.

The CVSS score is 6.4, indicating a moderate severity. No EPSS score is available, so the exploitation probability is unknown, but the vulnerability is documented and the attacker needs only Contributor‑level access to exploit it. It is not listed in the CISA KEV catalog. Attackers would authenticate and rely on the plugin’s insufficient input validation and lack of output escaping to deliver malicious code.