The Credits Shortcode plugin for WordPress contains a stored cross‑site scripting flaw tied to the 'link' attribute of the 'credits' shortcode. User supplied data for this attribute is not properly sanitized or escaped, allowing an authenticated attacker with contributor-level access or higher to inject arbitrary JavaScript. The injected script is stored in the post content and executed automatically whenever a page containing that content is viewed by any visitor.

All sites that have the Credits Shortcode plugin by jashjacob installed in a version up to and including 1.2 are affected. The vulnerability is present irrespective of the WordPress core version as long as the plugin is active and the 'credits' shortcode is used on a page or post.

The CVSS score of 6.4 classifies this vulnerability as medium severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, indicating no confirmed public exploitation as of the last advisory. The likely attack path requires an authenticated WordPress account with contributor or higher privileges to create or edit content that includes the shortcode. After injection, the malicious script remains in the stored content and is executed for any visitor to the affected page, providing a persistent cross‑site impact.