The faq shortocde plugin for WordPress contains a Stored Cross‑Site Scripting vulnerability that allows attackers with Contributor or higher privileges to inject arbitrary JavaScript through the 'color' attribute of the [faq] shortcode. The injected code runs in the browser context of any user who views the affected page, which can lead to credential theft, defacement, or session hijacking. This weakness corresponds to the Input Validation/Cross‑Site Scripting category (CWE‑79).

y = plugin 'faq shortocde' authored by yehudah, installed on all WordPress sites that use version 1.0 or earlier. The vulnerability affects any WordPress installation running the plugin up to and including version 1.0.

The CVSS score of 6.4 places the issue in the moderate severity range. Because the EPSS score is not available, the probability of exploitation is unknown but the fact that authenticated Contributors can exploit it raises concern. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be authenticated with a Contributor role or higher; once authenticated, they can create or edit a post that contains a crafted 'color' attribute, causing unescaped JavaScript to be stored and later executed for any viewer of the post.