The WP Shortcode by MyThemeShop plugin contains a flaw in the mts_tabs() function where the ‘title’ attribute of the [tab] shortcode is output directly inside anchor tags without any escaping. This allows an authenticated attacker with contributor‑level or higher credentials to store malicious JavaScript in the title. When a visitor loads a page that contains the injected tab, the script runs in the victim’s browser, potentially leading to credential theft, session hijacking, defacement, or further compromise of the site.

WordPress sites that have installed the WP Shortcode by MyThemeShop plugin in version 1.4.17 or earlier are affected. Any site regardless of theme or other plugins that uses the vulnerable plugin version and allows contributors or higher roles to edit content may be exploited. Upgrading to any patch released after 1.4.17 removes this vulnerability.

The CVSS score of 6.4 indicates a moderate impact. The EPSS score of less than 1 % shows a very low likelihood of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with contributor‑level or higher roles; the attacker injects the payload via the post editor or any interface that accepts shortcode parameters. Because the XSS is stored, it persists until the shortcode title is removed or the plugin is upgraded. The weakness is a classic CWE‑79 input validation/escaping flaw.