The gplusnamelink shortcode in the Google+ Link Name plugin allows an authenticated contributor or higher to embed arbitrary scripts. The plugin fails to sanitize its ‘id’ and ‘name’ attributes, concatenating them directly into HTML. An attacker can inject malicious JavaScript that will run in the browser of any user who views a page containing the compromised shortcode, potentially revealing credentials, defacing the site or installing malware.

WordPress installations using the Google+ Link Name plugin by morettolss, versions 1.0 or earlier. The vulnerability applies to all sites that enable the shortcode without additional restrictions.

The CVSS base score of 6.4 indicates moderate severity, and while no EPSS data exists, the lack of KEV listing suggests no confirmed widespread exploitation yet. Nevertheless, because the flaw requires only contributor‑level access, an attacker that gains such privileges can easily inject payloads. The vulnerability hinges on inadequate input sanitization (CWE‑79) and can be exploited when the plugin renders the shortcode’s attributes unchecked.