The Social Media Shortcodes plugin for WordPress (tw2113) suffers from a stored cross-site scripting vulnerability (CWE-79) in its 'patreon' shortcode due to improper input sanitization and output escaping of user-supplied attributes. This allows authenticated users with contributor-level or higher privileges to inject arbitrary JavaScript code that executes in the context of any user viewing the injected page. The vulnerability affects all plugin versions up to 1.3.0. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, requiring privileges at contributor level, no user interaction, and impacts confidentiality and integrity with no impact on availability. No patch or official fix is currently available, and no known exploits have been reported.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the page, potentially exposing sensitive information or enabling further attacks. The impact affects confidentiality and integrity but does not affect availability. Since the vulnerability requires authenticated access at contributor level, the risk is limited to environments where such user roles are granted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting contributor-level access to trusted users only or disabling the 'patreon' shortcode functionality if possible. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches promptly.