The seothemes Display Terms Shortcode plugin versions up to 1.0.4 suffer from a stored cross-site scripting (XSS) vulnerability due to improper input neutralization during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can compromise confidentiality, integrity, and availability to a limited extent. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, privileges required, user interaction needed, and partial impact on confidentiality, integrity, and availability. No patch or official fix has been documented at this time.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to inject and store malicious scripts that execute in the context of other users viewing the affected shortcode output. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user sessions. However, the attack requires user interaction and privileges, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Display Terms Shortcode plugin if feasible. Monitor for updates from seothemes regarding patches or mitigations. Avoid granting unnecessary privileges to users who can interact with the shortcode functionality.