The vaakash Shortcoder plugin versions up to 6.5.1 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows an attacker with low privileges and requiring user interaction to execute scripts in the context of the affected application, potentially impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). No patch or official remediation guidance is currently available from the vendor, and the product is not a cloud service.

Successful exploitation could allow an attacker with limited privileges to inject and execute malicious scripts in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability requires user interaction and affects the shared security scope (S:C). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit user privileges to trusted users only and exercise caution with user-generated content in the Shortcoder plugin. Monitor vendor channels for updates regarding patches or official mitigations.