CVE-2026-6255 is a stored cross-site scripting vulnerability in the Simple Owl Shortcodes WordPress plugin (sszdh project) affecting all versions up to 2.1.1. The issue is due to improper neutralization of input (CWE-79) in the 'num' attribute of the 'owls_wrapper' shortcode, allowing authenticated users with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. This can lead to unauthorized script execution in the browsers of users who view the affected content, potentially compromising user sessions or data confidentiality and integrity. There is no indication of impact on availability. No known exploits in the wild have been reported.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Simple Owl Shortcodes plugin if possible to prevent exploitation.