Authenticated attackers with Subscriber-level access and above can execute arbitrary shortcodes. This occurs because the plugin substitutes a user's `display name` into the page markup without filtering and processes the result using the `do shortcode()` function within `TheFrontend::replace content()`. Since the `display name` variable is editable by users via the core profile form, it can be manipulated to trigger this execution. If the affected page is a users collection, such as a team or member-directory page, the shortcode may execute for all visitors, including unauthenticated users. This issue requires a published page with a Kirki element where dynamic content is bound to the `display name` user field.