WordPress: Stored XSS via bnsfc Shortcode in BNS Featured Category Plugin

In BNS Featured Category plugin for WordPress versions up to and including 2.8.2 a medium severity vulnerability CVE-2025-5538 was detected. This vulnerability allows authenticated attackers with Contributor-level access or higher to inject malicious scripts via the bnsfc shortcode due to insufficient input sanitization and output escaping. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-5538.