The Animate Your Content plugin for WordPress contains a stored cross‑site scripting flaw that enables attackers with contributor‑level or higher privileges to inject arbitrary scripts through the animation‑set shortcode. The vulnerability arises because user‑supplied attribute values are concatenated directly into double‑quoted HTML attributes without proper sanitization or escaping. When a page containing the malicious shortcode is viewed, the injected script runs in the victim's browser.

Any WordPress site running the Animate Your Content plugin by fides‑it with a version of 1.0.0 or earlier is affected. Site administrators should inventory the plugin version on their sites and evaluate whether any user accounts possess contributor or higher capabilities that could be used to create or edit content containing the animation‑set shortcode.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate to the WordPress site with at least contributor privileges to add or modify content containing the malicious shortcode. Once injected, the script executes each time a visitor loads the affected page, providing the attacker with the ability to run client‑side code in the context of the site’s visitors.