The Simple Random Posts Shortcode plugin allows authenticated users with contributor-level access to insert arbitrary JavaScript into posts by using the "container_right_width" attribute of the "simple_random_posts" shortcode. The plugin fails to sanitize or escape this attribute before outputting it, enabling a stored XSS flaw classified as CWE‑79. When a visitor loads the affected page, the injected script executes in their browser, potentially hijacking sessions, defacing content, or redirecting to malicious sites.

WordPress installations that include mkerstner's Simple Random Posts Shortcode plugin version 0.3 or earlier. The vulnerability exists in all releases up to and including 0.3; newer releases are presumed to contain the fix.

The CVSS score of 6.4 indicates medium severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, so exploitation odds are uncertain but not zero. Attackers must first authenticate with contributor or higher privileges, then create or edit a post to embed the malicious shortcode. Once any user visits the page, the payload runs, compromising confidentiality and integrity of the victim’s session.