The Shortcode Buddy plugin contains insufficient input sanitization and output escaping for shortcode attributes. This flaw enables authenticated users with contributor or higher privileges to store malicious JavaScript in content that will execute whenever any site visitor opens the affected page. Successful exploitation could deface or alter content, steal session cookies, or serve further malware to other users.

WordPress sites that use the Shortcode Buddy plugin by Vincent Astolfi, version 0.1.9.5 or earlier.

The CVSS score of 6.4 classifies this flaw as medium severity. EPSS data is not available. The issue is not listed in CISA KEV. The typical attack path requires the attacker to be authenticated with at least contributor access and the ability to edit or create shortcodes. Once a malicious shortcode is saved, the embedded script runs automatically for any visitor who views the affected page.