The KIA Subtitle plugin for WordPress contains a stored cross‑site scripting flaw that lets an authenticated attacker with Contributor or higher privileges inject arbitrary JavaScript into the "before" and "after" attributes of the "the‑subtitle" shortcode. Because the plugin does not sanitize or escape these attributes, the injected script is persisted and executed in the browser whenever a user views a page containing the shortcode. This vulnerability can be leveraged to hijack sessions, deface content, or exfiltrate information from the victim’s browser.

The affected component is the helgatheviking:KIA Subtitle plugin, versions up to and including 4.0.1. WordPress sites that have installed these versions and grant at least Contributor permissions are vulnerable. Upgrading to 4.0.2 or later eliminates the flaw.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score is not reported. Because the exploit requires authenticated access but only contributor‑level roles, it can be used by a wide range of internal users or compromised accounts, but it is not listed in CISA’s KEV catalog. An attacker would embed malicious code within an existing post or page via the shortcode editor, and the script would run for all subsequent visitors to that content.