The kallyas WordPress theme up to version 4.23.0 contains a stored cross-site scripting (XSS) vulnerability in several plugin shortcodes. This flaw arises from insufficient sanitization and escaping of user-supplied shortcode attributes, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute whenever any user views the affected pages, potentially compromising user interactions and data.