The WooCommerce Cart Count Shortcode plugin for WordPress versions up to 1.0.4 contains a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'cart_button' shortcode. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts via insufficient input sanitization and output escaping of user-supplied shortcode attributes. These scripts execute in the context of any user visiting the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity but not availability. No patch or official fix is currently available, and no known exploits have been reported.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially compromising user sessions or data confidentiality and integrity. The vulnerability does not affect availability. The medium CVSS score reflects the need for authenticated access and the impact on confidentiality and integrity.

No official patch or fix is currently available for this vulnerability. Users should monitor the prontotools vendor advisories for updates and apply patches once released. Until a fix is available, consider restricting contributor-level access to trusted users only and disabling or removing the WooCommerce Cart Count Shortcode plugin or the 'cart_button' shortcode functionality to prevent exploitation.