The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to stored cross‑site scripting because the plugin fails to sanitize and escape user‑supplied shortcode attributes. An attacker can embed arbitrary JavaScript in the class attribute of generated <pre>/<code> blocks. This flaw is a classic input‑validation weakness (CWE‑79) that allows remote code execution in the browser of any user who views the affected page.

The vulnerability affects the WordPress plugin 'Easy Prism Syntax Highlighter' by cuamckuy on all versions up to and including 1.0.2. WordPress sites that have installed this plugin and allow contributors or higher to add or edit content are at risk.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score is not available, so the likelihood of exploitation in the wild is uncertain. The flaw requires authenticated access with contributor‑level or higher privileges, but once a malicious payload is stored it will execute for every user who visits the affected page. The vulnerability is not listed in the CISA KEV catalog, and no public exploitation has been reported at the time of writing.