The Featured Image plugin for WordPress contains a stored cross‑site scripting flaw that allows attackers with administrator privileges to inject arbitrary JavaScript via image metadata. The plugin fails to sanitize and escape this input, so the malicious scripts are rendered and executed whenever a user views a page with the injected image. This can lead to session hijacking, phishing, defacement, or other client‑side compromise, affecting confidentiality, integrity, and availability of the site.

The vulnerability affects all releases of the Featured Image plugin up to and including version 2.1. It only applies to multi‑site WordPress installations where the unfiltered_html capability has been disabled, and requires an authenticated user with administrator‑level permissions or higher. In practice, any site running the vulnerable plugin on version 2.1 or older that permits high‑privilege users to upload images is at risk.

With a CVSS score of 4.4 the flaw is categorized as moderate, and the EPSS score is below 1 %, indicating a low likelihood of exploitation at the moment. The flaw is not listed in the CISA KEV catalog, but attackers possessing sufficient administrative rights could leverage the stored XSS to compromise other site users. The attack vector is local to the site's admin account, so the risk is limited to privileged users, but once the attacker injects the payload, any visitor to the affected page can be affected.