The GNTT Post Title Ticker plugin for WordPress is vulnerable to stored cross‑site scripting because several shortcode attributes—border, width, height, header_background, header_text_color, and id—are not sanitized or escaped before being output. This omission allows an attacker to embed arbitrary JavaScript within a page, which will run in the browsers of any visitor who loads that page.

The affected vendor is golzarrahman, the GNTT Post Title Ticker plugin for WordPress, version 1.0 and earlier. All installations using this product, regardless of the WordPress core version, are vulnerable until the plugin is updated to a release that implements proper sanitization and escaping for the shortcode attributes.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. An authenticated user with contributor‑level access or higher can create or edit content that includes the vulnerable shortcodes, so it is inferred that the attack vector involves the WordPress admin interface. Once a malicious script is stored, it will execute client‑side whenever any user accesses the affected page, thereby exposing all site visitors to the embedded code.