The Github Shortcode WordPress plugin (octalmage) suffers from a stored XSS vulnerability due to improper neutralization of input in the 'repo' shortcode attribute. This allows authenticated contributors or higher to inject arbitrary JavaScript into pages, which executes in the context of users viewing those pages. The vulnerability affects all versions up to 0.1. The CVSS 3.1 score of 6.4 reflects network attack vector, low attack complexity, and privileges required at the contributor level, with no user interaction needed and a scope change. No official patch or fix has been published yet.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into WordPress pages via the 'repo' shortcode attribute. These scripts execute in the browsers of users who view the compromised pages, potentially leading to theft of user credentials, session hijacking, or other client-side attacks. The impact is limited by the requirement for contributor-level privileges to inject the payload. There is no indication of denial of service or server-side compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the Github Shortcode plugin if possible. Monitor for plugin updates from the vendor and apply official patches promptly once released.