The Codeless Page Builder WordPress plugin through version 1.1.4 fails to sanitize or validate a shortcode attribute before using it as an HTML tag name during content rendering. This flaw enables users with contributor-level permissions or above to inject arbitrary HTML and JavaScript code. When higher-privileged users, such as administrators, view the content containing the malicious shortcode, the injected script executes within their session context, leading to a cross-site scripting (XSS) vulnerability classified as CWE-79.

An attacker with contributor-level access can exploit this vulnerability to execute arbitrary JavaScript in the browser of higher-privileged users who view the malicious content. This can lead to session hijacking, privilege escalation, or other attacks within the context of the affected WordPress site. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid viewing untrusted content created by contributors. Monitor the vendor's channels for updates and apply patches promptly once released.