The Shariff for WordPress plugin, versions up to 1.0.11, fails to sanitize the shariff_infourl setting before rendering it in the frontend. This omission allows users with high privileges, such as administrators, to inject arbitrary script content that is stored in the database and later delivered to other visitors. An attacker can use this flaw to execute JavaScript in the browsers of any user who views a page with the affected widget, enabling session hijacking, credential theft, or malicious redirects.

The affected product is the Shariff for WordPress plugin version 1.0.11 and earlier. Administrators and other privileged users who configure the widget are at risk. The vulnerability applies to installations that enable the Shariff plugin and allow administrators to modify the shariff_infourl setting through the WordPress admin interface.

The vulnerability is a stored XSS flaw (CWE‑79) that can be exploited by an attacker who already has administrator access to the site. Because the input is not escaped, the attacker can inject a script that will execute in the context of every visitor to pages rendering the widget. The EPSS score is not available and the issue is not listed in CISA KEV, but the potential for privilege escalation and widespread user impact still makes the risk high. The attack vector is through the admin interface where the malicious value is entered, and exploitation requires no special user interaction beyond viewing the affected page.