The Tuxquote plugin for WordPress lets users insert a TUXQUOTE shortcode that accepts user‑supplied attributes such as title, align, and width. In versions 1.3 and earlier these attributes are concatenated directly into the rendered HTML without passing through sanitizing functions, allowing stored cross‑site scripting. An attacker who can create or edit a page with Contributor level or higher can inject arbitrary JavaScript that will execute automatically whenever any site visitor loads the affected page.

This vulnerability targets the eldougo Tuxquote WordPress plugin for all WordPress installs that use version 1.3 or lower. No other versions or products are listed as affected.

The CVSS score of 6.4 classifies the issue as moderate severity. EPSS data are not available, so a precise exploit probability cannot be given, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. However, because the attack requires Contributor or higher access, the potential impact is confined to sites where such roles are granted, and anyone with those permissions can inject malicious scripts that affect all users who view the compromised content.