The vulnerability resides in the Voyage Plus WordPress plugin (up to and including version 1.0.6). Insufficient input sanitization of the 'class' attribute in the 'post-content' shortcode allows an attacker who can log into the site with contributor‑level or higher permissions to store malicious JavaScript code in a page. When an authenticated user creates or edits a page containing the crafted shortcode, the malicious script is persisted in the database and will execute in the browsers of any subsequent visitor to that page, enabling session hijacking, data theft, or defacement. The weakness aligns with CWE‑79, a classic stored XSS flaw.

All WordPress installations using the Voyage Plus plugin version 1.0.6 or earlier are affected. The plugin is distributed by scui2 as Voyage Plus. No specific WordPress core or PHP version information is supplied, so any environment running the vulnerable plugin should be considered at risk.

The CVSS score of 6.4 indicates moderate severity. EPSS data is not available, so a quantitative likelihood of exploitation cannot be determined from the current data. The vulnerability is not listed in the CISA KEV catalog. It is inferrable that the attack requires authenticated access with at least contributor rights; therefore an attack path would involve an attacker logging into the site (or credential compromise) and exploiting the shortcode input that is not trimmed of arbitrary scripts. Once leveraged, the malicious code runs in the context of any user visiting the induced page.