The Github Shortcode plugin for WordPress contains a stored cross‑site scripting flaw tied to the ‘repo’ attribute of the ‘github’ shortcode. Input supplied in this attribute is inadequately sanitized and the resulting value is not properly escaped when rendered, which allows an authenticated contributor or higher to inject malicious scripts. These scripts are executed automatically whenever any user views a page containing the crafted shortcode, providing the attacker with the ability to run arbitrary JavaScript in the victim’s browser, potentially leading to cookie theft, session hijacking, or defacement.

The vulnerability affects all installations of the octalmage Github Shortcode plugin that are at version 0.1 or earlier. The plugin is intended for use with WordPress sites; therefore, any WordPress installation that has this version of the plugin installed is exposed.

The CVSS score of 6.4 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known active exploitation campaigns. The attack requires a user with Contributor privileges or higher within the WordPress site, making the threat primarily internal or to sites hosting compromised accounts. Given the reliance on site‑wide content rendering, a successful attack would affect all visitors who view the injected page.