Contributor-level stored XSS via unescaped shortcode attributes

Stored XSS in Katsushi Kawamori Child Pages Card before 1.09 allows remote authenticated users to inject script through shortcode attributes. The shortcode renderer places the color value inside a style attribute and the imgsize value inside an img tag without escaping quotes, enabling injected event-handler attributes. Contributor access, a parent page with a child page, and editorial publication are required; the script runs under the site's origin when the page is viewed or the injected element receives focus.