The wp‑twitpic plugin contains a stored cross‑site scripting vulnerability (CWE‑79) that allows an authenticated user with Contributor‑level or higher privileges to inject arbitrary scripts via multiple parameters of the ‘twitpic’ shortcode. When a user opens a page containing the maliciously crafted shortcode, the injected script executes in that user’s browser, potentially leading to session hijacking, defacement, or further attacks within the authenticated user’s session.

This flaw affects the Realin wp‑twitpic WordPress plugin, all released versions up to and including 1.0, when installed on any WordPress site that assigns contributor or higher roles. Sites employing this plugin and running the vulnerable version are at risk.

With a CVSS score of 6.4, the vulnerability is of medium severity. The EPSS score of less than 1 % suggests low likelihood of exploitation, and the flaw is not currently listed in the CISA KEV catalog. However, exploitation requires only a legitimate contributor‑level account, so compromised credentials or social engineering can provide the necessary access. The attacker need only supply malicious shortcode parameters, so the attack vector is straightforward once authenticated, and the impact is confined to page rendering for any user who views the injected content.