The Simple Owl Shortcodes plugin for WordPress contains a stored cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript through the 'num' attribute of the 'owls_wrapper' shortcode. The deficiency arises because the attribute is not properly sanitized or escaped before rendering in pages. Based on the description, it is inferred that any script executed in the victim’s browser could potentially read cookies, perform actions on behalf of the user, or exfiltrate data, but the CVE report does not state that these extensions have been observed.

All WordPress sites that have the Simple Owl Shortcodes plugin installed in a version up to and including 2.1.1 are affected. The plugin is distributed by the vendor sszdh. Any user with contributor-level privileges or higher can modify content that contains the owls_wrapper shortcode and insert a malicious 'num' value.

The CVSS score of 6.4 indicates medium severity, and no EPSS score is available. The flaw requires authenticated access; there is no public exploit yet and it is not listed in the CISA KEV catalog. An attacker must first obtain contributor or higher rights to the site, after which they can store malicious code that will be executed for all visitors to pages containing the shortcode. The overall risk is medium but it can lead to serious consequences if the injected script is able to hijack sessions or perform other malicious actions.