The Filestack WordPress plugin (shanaver Filestack) suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of user-supplied input in the 'filepicker' shortcode. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of other users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The vulnerability affects all versions up to 2.0.8. There is no vendor advisory or patch information provided, and no known exploits have been reported.

Successful exploitation allows an authenticated contributor-level or higher user to inject persistent malicious scripts into WordPress pages via the Filestack plugin. These scripts execute in the browsers of users who visit the injected pages, potentially leading to limited disclosure of information and modification of content within the affected site context. There is no indication of availability impact. The vulnerability does not require user interaction beyond visiting the compromised page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Filestack plugin if possible to prevent exploitation.