The jQuery googleslides plugin for WordPress allows authenticated users with contributor or higher privileges to inject arbitrary scripts into posts by using the googleslides shortcode. Because the plugin concatenates user‑supplied shortcode attributes directly into single‑quoted HTML attributes without proper escaping, this flaw is a stored cross‑site scripting vulnerability (CWE‑79). An attacker can store malicious JavaScript that will run in the browser whenever any visitor views a page containing the shortcode. The CVE description does not explicitly state the potential consequences, but based on typical XSS behavior, it is inferred that attackers could potentially cause data theft, session hijacking, or defacement.

The vulnerability affects the WordPress plugin "jQuery googleslides" developed by bradyholt, versions 1.3 and earlier. Users who are contributors or have higher roles on the site can exploit it, provided the malicious shortcode is inserted into editable content such as posts or pages.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available, but the lack of a KEV listing suggests no widespread exploitation at this time. The attack requires authenticated access with contributor or higher permissions and the ability to insert or edit the googleslides shortcode. Once the shortcode containing malicious attributes is stored, the attack automatically executes whenever a visitor loads the affected page, making exploitation easy for the attacker, though the specific impact on end users is not detailed in the CVE description.