WordPress Shortcode in Comment Plugin Cross-Site Request Forgery Vulnerability Allowing Stored Cross-Site Scripting

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the WordPress Shortcode in Comment plugin, specifically in versions through 1.1.1. This vulnerability allows for Stored Cross-Site Scripting (XSS) attacks, where a malicious actor could exploit higher privileged users into performing unintended actions under their current authentication.

Impact

Exploitation of this vulnerability could enable a malicious actor to manipulate higher privileged users into executing undesired actions, potentially leading to Stored Cross-Site Scripting.