The PhotoFade plugin for WordPress contains a stored Cross‑Site Scripting flaw that originates from insufficient input sanitization and output escaping of the 'time' attribute used in the plugin's shortcodes. Authenticated users with Contributor‑level access or higher can embed arbitrary JavaScript code that is persisted in the post or page content and executed every time any visitor displays the affected page. This flaw is a classic injection weakness, classified as CWE‑79, which can lead to the execution of malicious script in the context of browsing a site that uses the plugin.

The vulnerability affects the PhotoFade plugin developed by davidangel. WordPress sites that have a copy of the plugin in any version up to and including 0.2.1 are at risk. The issue is independent of the core WordPress version; any page, post, or custom post type that includes the plugin’s shortcode may store injected content.

The CVSS score of 6.4 indicates a moderate impact, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with a Contributor role or higher, after which they can inject the malicious script via the 'time' attribute. The stored payload is then rendered to all visitors of the affected content, potentially allowing the attacker to run JavaScript code in the context of normal site users.