The Faces of Users plugin for WordPress contains a stored cross‑site scripting flaw in the handling of the 'default' attribute of the 'facesofusers' shortcode. When an authenticated user with Contributor or higher privileges creates or edits a shortcode containing malicious script tags, the content is stored without adequate sanitization or escaping. Subsequent page loads render the injected script, allowing the attacker to execute arbitrary JavaScript in the browsers of any visitor to that page. The weakness is cataloged as CWE‑79.

Users of the Faces of Users WordPress plugin, developed by mcinvale, are affected. All releases up to and including version 0.0.3 contain the bug; later releases, if any, are not known to be affected.

The CVSS score of 6.4 reflects moderate severity, and no EPSS data is available. Because the vulnerability requires only authenticated access at the Contributor level, many sites may have eligible users, increasing the likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no currently documented exploitation. Attackers can trigger the flaw by inserting malicious payloads in the default attribute; the payload is stored and served on every subsequent visit to the affected page, enabling persistent cross‑site scripting attacks.