The Dino Game WordPress plugin suffers from a stored XSS vulnerability (CWE-79) in its 'dino-game' shortcode. This flaw allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code via insufficiently sanitized shortcode attributes. When other users access pages containing the injected shortcode, the malicious scripts execute in their browsers. The vulnerability affects all plugin versions up to 1.1.0. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity. There is no vendor advisory or patch link available at this time.

An attacker with contributor-level access can inject persistent malicious scripts into WordPress pages using the vulnerable shortcode. These scripts execute in the context of users viewing the page, potentially leading to theft of sensitive information, session hijacking, or other client-side attacks. The impact is limited to confidentiality and integrity with no availability impact. Since the attacker must be authenticated with contributor or higher privileges, the risk is mitigated by access controls but remains significant in environments where such users are not fully trusted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only. Consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor for updates from the plugin author or WordPress security channels for a patch or official mitigation.