The Next Date WordPress plugin contains a stored cross‑site scripting flaw that allows an authenticated user with contributor or higher privileges to insert arbitrary scripts into the ‘default’ shortcode attribute. The injected code is then executed whenever a page containing the shortcode is rendered, potentially compromising user sessions and leaking data. The weakness is a lack of sanitization and output escaping—a classic XSS vulnerability (CWE‑79).

WordPress sites that have installed the Next Date plugin version 1.0 or earlier, regardless of the specific WordPress version. Any user who has contributor–level or higher permissions on the affected site can exploit the flaw.

The CVSS score of 6.4 classifies this as a moderate severity vulnerability. No EPSS score is available, but the lack of a public exploit and its limited attack surface (requiring contributor access) reduces the immediate risk. The vulnerability is not listed in CISA KEV, and it can only be triggered by attackers who already have authenticated contributor-level access. Exploitation would involve editing posts or pages that include the Next Date shortcode and embedding malicious JavaScript into the default attribute.