The Memberlite Shortcodes plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its memberlite_accordion shortcode. This occurs because user input is not properly sanitized or escaped before being included in web pages. Attackers with contributor-level or higher privileges can inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. This vulnerability affects all plugin versions up to 1.3.9. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No patch or vendor advisory is currently provided, and no known exploits have been reported.

An authenticated attacker with contributor-level access or higher can inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the page, potentially compromising user data confidentiality and integrity. There is no impact on availability reported. The medium CVSS score reflects these impacts and the required privileges for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Memberlite Shortcodes plugin if feasible. Monitor for vendor updates to apply an official patch once available.