The Instant‑Quote.co Quotation Page plugin for WordPress is vulnerable to stored cross‑site scripting via shortcode attributes in versions up to 1.3.4. Insufficient input sanitization and output escaping allow an authenticated contributor or higher to embed arbitrary JavaScript that will run whenever a user views a page containing the vulnerable shortcode. The description does not mention any other capabilities such as remote code execution or information disclosure.

All installations of the Instant‑Quote.co Quotation Page WordPress plugin with versions 1.3.4 or earlier are affected. WordPress sites that permit contributors to use shortcodes are at risk. No additional platform or system requirements are noted.

The CVSS score of 6.4 indicates medium‑to‑high severity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could embed a malicious shortcode into a post, have the post reviewed or previewed by a higher‑privileged user, and when that user views the post the injected script would execute. The required access level is contributor or higher, which is relatively easy to obtain in many compromised websites. Thus, while the flaw does not allow arbitrary code execution on the server, its impact on the confidentiality and integrity of users who view the affected content warrants prompt remediation.