The Rescue Shortcodes plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the rescue_progressbar shortcode. This vulnerability is due to inadequate sanitization and escaping of user-supplied attributes, enabling authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. When other users access the compromised page, the injected scripts execute, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to 2.9 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No patch or remediation has been documented in the provided data.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the rescue_progressbar shortcode. These scripts execute in the context of users who view the infected pages, potentially leading to partial confidentiality and integrity loss (e.g., theft of cookies or manipulation of page content). Availability is not impacted. The vulnerability requires authenticated access, limiting exposure to users who can contribute content. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Rescue Shortcodes plugin if feasible. Monitor for updates from the vendor to apply any forthcoming patches promptly.