The vulnerability arises from missing output escaping in the as_get_coin_shortcode() function of the Cryptocurrency Prijsvergelijking Widget plugin. An attacker that can add or edit shortcode attributes can supply a crafted value for the width attribute, ending the style attribute and inserting arbitrary HTML attributes into an iframe. Once stored, the malicious markup runs in any browser that loads a page containing the shortcode, allowing arbitrary scripts to execute under the user’s session. This flaw is only exploitable by users who have contributor‑level or higher access to the WordPress site, because the attacker must be able to create or modify the shortcode where the width attribute is stored. No network‑level or unauthenticated vector is required. Given the CVSS score of 6.4 (medium), the absence of an EPSS score, and no listing in CISA KEV, the risk is moderate but still potentially high for sites that rely on this widget and have contributors with editing rights. A single malicious contributor could compromise all visitors to pages that use the widget.

WordPress sites that have installed the Cryptocurrency Prijsvergelijking Widget plugin version 1.0 from the provider cryptoprijzen. The vendor/product is listed as Cryptocurrency Prijsvergelijking Widget. The affected versions are not further refined in the CNA data, but the vulnerability description explicitly states that it exists in version 1.0. No other vendors or product versions are indicated as affected.

The CVSS score of 6.4 indicates a medium severity. Because the exploit requires authenticated access to WordPress with contributor or higher role, the attack vector is internal and depends on the site’s role configuration. There is no documented EPSS score and the vulnerability is not listed in CISA KEV, suggesting it is not known to be actively exploited in the wild yet. Defenders should assume that a malicious contributor could inject persistence‑level XSS, leading to cookie theft, session hijacking, or redirection for all users who view a page containing the injected shortcode. Mitigations are available only through updating the plugin or applying a patch; there is no official workaround listed in the input.