The Formidable Kinetic plugin implements a shortcode whose attributes – notably 'window', 'class', and 'label' – are inserted directly into an anchor tag without sanitization or escaping. This insufficient input handling creates a stored Cross‑Site Scripting flaw (CWE‑79). An attacker who can add or edit these shortcodes, such as a contributor or higher‑level user, can inject arbitrary JavaScript that will run in the browsers of any visitor who views the affected page. The resulting script can hijack user sessions, steal credentials, or deliver additional malicious payloads. The primary impact is compromised confidentiality and integrity of user sessions and the website’s content.

Vendor thomstark provides the Formidable Kinetic plugin for WordPress. Versions up to and including 1.1.01 contain the vulnerable shortcode handling. All installations running 1.1.01 or earlier are affected.

The CVSS score of 6.4 indicates moderate severity, with the exploit limited to sites where the attacker has at least contributor‑level access. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Attackers must first gain authenticated contributor privileges on the target WordPress site, then create or modify a kinetic_link shortcode containing malicious attributes. Once stored, the payload executes automatically for any user who views the page. Because the flaw is stored and only requires local site privileges, the window of opportunity is constrained to compromised sites, but the impact for each affected user can be significant.