Stored cross-site scripting occurs due to insufficient input sanitization and output escaping. Authenticated users with Contributor-level access and above can inject arbitrary web scripts via the `base-url` attribute of the `[mpg]` and `[mpg match]` shortcodes. Attackers can use entity-encoded payloads that bypass kses (a WordPress function used to sanitize HTML) but are subsequently decoded by `html entity decode()` and rendered unescaped through `{{mpg url}}`, leading to script execution in the browsers of administrators.