The WP‑Force Images Download plugin is vulnerable to a stored cross‑site scripting flaw that occurs when an authenticated user with contributor‑level privileges inserts content using the ‘wpfid’ shortcode. The flaw is caused by inadequate sanitization of the shortcode’s class attribute, resulting in arbitrary JavaScript code being stored in the database and executed whenever a page containing the shortcode is rendered.

The vulnerability affects the WP‑Force Images Download plug‑in for WordPress, versions all the way through 1.8. It is not limited to a particular WordPress installation, so any site running the plug‑in at or below this version is potentially exposed.

The CVSS score of 6.4 indicates a moderate severity, and an EPSS score of under 1 % suggests the likelihood of exploitation is currently low. The plug‑in is not listed in the CISA KEV catalog. Because the attack requires authentication and contributor‑level access, an authorized attacker can inject malicious scripts that will run for every visitor to the affected page, making the risk substantial if such users exist.