The vulnerability arises from the Wavr plugin's `wave` shortcode not properly sanitizing and escaping user‑provided attributes. An authenticated user with contributor or higher privileges can embed arbitrary JavaScript that is stored and executed whenever a page containing the shortcode is accessed. This results in persistent cross‑site scripting, allowing the attacker to steal session cookies, inject tracking scripts, or perform other malicious actions on behalf of site visitors.

Affected systems are WordPress installations that use the Wavr plugin version 0.2.6 or earlier. The vendor is lucascaro. All releases up to and including that version are impacted, as the source code shown in the references contains the vulnerable functions. Sites that still run any of these versions, regardless of their specific WordPress version, are susceptible.

The CVSS base score of 6.4 indicates a moderate impact, and the requirement of authenticated contributor access limits the attack surface to users with site privileges. Because there is no EPSS score and no listing in KEV, the likelihood of exploitation is uncertain, but the potential impact on confidentiality, integrity, and availability of all site visitors is significant. The vulnerability is therefore a moderate‑to‑high risk for sites where the shortcode is used and where contributors are trusted but could be compromised.