The Extra Post Images plugin for WordPress allows the ‘id’ attribute of its shortcode to be stored without proper sanitization or escaping, creating a stored cross‑site scripting vulnerability. This flaw is classified as CWE‑79 and permits an attacker who can authenticate as a Contributor or higher to inject arbitrary JavaScript into pages containing the shortcode. When an affected user views the page, the injected scripts execute in that user’s browser, potentially leading to defacement, session hijacking, or other client‑side attacks.

Any WordPress site running the Extra Post Images plugin version 1.0 or earlier is potentially affected. The vulnerability affects the plugin code in the core shortcode handler and does not require any external services or plugins. All WordPress installations that have granted Contributor or higher roles the ability to add or edit posts with the plugin’s shortcode are within scope.

The CVSS base score of 6.4 indicates a moderate impact with authentication required, but the low EPSS score of < 1% suggests a small probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, meaning there is no known widespread exploitation. Attackers would need to log into the site with a Contributor‑level account, inject the malicious shortcut into a post, and rely on other site users to view the compromised page to trigger the script. The main risk is client‑side compromise, with no immediate server‑side backdoor creation.