The Simple Owl Shortcodes plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'num' attribute of the 'owls_wrapper' shortcode. This affects all versions up to and including 2.1.1. The vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.