The Vulnerability is a stored cross‑site scripting flaw triggered when users with contributor‑level or higher authority insert malicious content through the 'style' attribute of the qtbl shortcode. The insufficient sanitization allows arbitrary JavaScript to be written to the page, which will execute in the browsers of any visitor viewing the affected page. This can lead to theft of user credentials or session data, defacement of content, and possible lateral movement within the site.

This flaw affects the Quick Table plugin by rdcravens, versions up to and including 1.0.0. Any WordPress installation that has this plugin installed (and is not patched to a newer release) is vulnerable.

The vulnerability receives a CVSS score of 6.4, indicating a high impact with an authentication requirement. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers need legitimate contributor+ credentials to exploit the flaw, after which they can inject and store malicious scripts, causing the code to run on subsequent page views by other site visitors.