The Mikado Core plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation. Specifically, user-supplied shortcode attributes are not adequately sanitized or escaped, allowing attackers with contributor-level or higher privileges to inject arbitrary JavaScript code. This code executes in the context of users who visit the compromised pages, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to 1.5.2. No patch or official fix details are currently available.

An authenticated attacker with contributor-level or higher permissions can exploit this vulnerability to inject and execute arbitrary scripts in the browsers of users who view the compromised pages. This can lead to information disclosure or session hijacking. The vulnerability does not affect availability and has a medium severity rating with a CVSS score of 6.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions carefully and consider disabling or limiting the use of shortcodes in Mikado Core. Monitor for updates from Mikado Themes regarding patches or mitigations.