The Scoreboard for HTML5 Games Lite plugin for WordPress contains a stored XSS vulnerability via its 'scoreboard' shortcode. The shortcode function sfhg_shortcode() permits arbitrary HTML attributes on an iframe element, blocking only a small set of attribute names. Although attribute names and values are escaped with esc_html() and esc_attr(), this does not prevent injection of JavaScript event handler attributes such as onfocus or onmouseover. Because the shortcode content is stored in post_content and rendered after WordPress's kses filtering, authenticated users with Contributor or higher privileges can inject malicious scripts that execute in the context of any user viewing the page.

An attacker with Contributor-level access or higher can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not allow privilege escalation or denial of service directly but compromises the integrity and confidentiality of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only. Avoid using the vulnerable shortcode or remove the plugin if possible. Monitor for plugin updates from demonisblack that address this vulnerability and apply them promptly once released.