Treat this vulnerability as more severe than its 6.8 CVSS rating suggests. The issue isn't merely that a Contributor can inject XSS — the shortcode rendering context collapses the intended privilege boundary between Contributors and the users who review their submissions.
The root cause is how WordPress handles shortcode attributes. The shortcode_atts() function merges user-supplied input with developer defaults, but it provides no enforcement mechanism for which attributes should remain under developer control versus being user-overridable. A plugin author sets what feel like safe defaults, uses them in output, and never realizes that shortcode_atts() silently allows any attribute to be overridden by user input. This is API design teaching bad habits, not developer negligence.
The attack pathway is where the real severity lies. When a Contributor submits a post containing a malicious shortcode, it executes automatically when a reviewing Author or Editor opens that post — in the block editor preview pane, during autosave operations, or in the theme customizer. The Contributor doesn't need to social-engineer anyone into visiting a crafted page; they submit the content and the XSS fires the moment anyone opens their post for review. This transforms the vulnerability from something requiring victim interaction into automatic execution at the editorial pipeline's chokepoint.
Your risk depends on two questions. First, do you allow Contributor-level registrations? If so, every Contributor becomes a potential vector against your review process. Second, does your review workflow render shortcodes in the admin interface? Modern WordPress does this by default, and disabling it requires explicit configuration.
The fix characterization matters more than typical CVE descriptions acknowledge. Determine whether the patch applied proper attribute whitelisting, simple escaping, or removed the attribute entirely — each leaves different residual exposure. If the developer escaped one attribute without understanding the underlying pattern, similar vulnerabilities likely persist in other shortcodes within the same plugin.