The Puzzles theme for WordPress, developed by ThemeREX, is vulnerable to stored cross-site scripting (CWE-79) due to improper neutralization of input during web page generation. Specifically, shortcode attributes supplied by authenticated users with contributor-level or higher permissions are not properly sanitized or escaped, enabling injection of arbitrary scripts. These scripts persist in the page content and execute in the context of any user viewing the page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects versions up to and including 4.2.6. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at contributor level, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no known exploit in the wild and no vendor patch or advisory currently provided.

An authenticated attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages via shortcodes. These scripts execute in the context of any user viewing the infected page, potentially compromising user sessions or performing unauthorized actions within the victim's browser context. The impact affects confidentiality and integrity but does not affect availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions carefully and consider disabling shortcode usage by contributors if possible. Monitor for updates from ThemeREX regarding patches or mitigations. Avoid granting contributor or higher permissions to untrusted users.