The Ad Short plugin for WordPress suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping of the 'client' attribute in the 'ad' shortcode. The shortcode handler ad_func() accepts the 'client' attribute and directly inserts it into a double-quoted HTML attribute (data-ad-client) without applying esc_attr() or equivalent sanitization. This flaw enables authenticated attackers with Contributor-level privileges or higher to inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages.

Successful exploitation allows an attacker with Contributor-level or higher access to inject persistent malicious scripts into pages via the 'client' shortcode attribute. These scripts execute in the browsers of users who view the infected pages, potentially leading to theft of session tokens, defacement, or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher access to trusted users only. Avoid using the vulnerable 'client' attribute in the 'ad' shortcode or remove the Ad Short plugin if possible. Monitor for plugin updates from nocaredev that address this vulnerability.