The NMR Strava activities WordPress plugin allows any authenticated user with contributor‑level access to craft shortcode attributes that are not properly sanitized or escaped. By inserting malicious markup into a "strava_nmr_connect" shortcode, an attacker can store arbitrary JavaScript or HTML. When any visitor loads the page containing the injected shortcode, the attacker's code runs in that visitor’s browser, potentially stealing session cookies, hijacking the user’s account, or defacing the site. This is a classic Stored Cross‑Site Scripting vulnerability (CWE‑79).

The vulnerability exists in all releases of the NMR Strava activities plugin from mirceatm up to and including version 1.0.14. No other versions or components are known to be affected.

The CVSS score of 6.4 indicates a moderate baseline risk. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation is moderate but not negligible. Attacking requires only contributor‑level permissions, a role that is commonly granted in many WordPress installations. Once the short­code is populated with a malicious attribute, the payload is automatically stored and will run for any site visitor, giving attackers persistent, client‑side code execution capabilities.