The MIR blocks and shortcodes plugin for WordPress contains a stored cross‑site scripting flaw in the msc_stats shortcode. The plugin renders the title attribute and other attributes without sanitizing user input, allowing a contributor‑level user to embed arbitrary JavaScript. When a site visitor opens a page that contains the compromised shortcode, the injected script executes in the visitor's browser, potentially stealing cookies, hijacking sessions, or defacing the page.

WordPress sites running the MIR blocks and shortcodes plugin version 1.0.0 or earlier are affected. The flaw is present only when the msc_stats shortcode is used, and it requires a user with contributor or higher permissions to edit or create content containing shortcodes. Sites that have the plugin installed and allow contributors to add or edit posts or pages are at risk.

The CVSS Base score of 6.4 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. A successful exploitation requires an authenticated user with contributor or higher privileges, who can add or edit a post containing the msc_stats shortcode. Because the injected payload is stored and then delivered to all other site visitors, the impact can affect any user who loads the compromised page.