The TR Timthumb plugin for WordPress is vulnerable to Stored Cross‑Site Scripting through shortcode attributes in all versions up to 1.0.4 because the plugin does not adequately sanitize input or escape output. An attacker who has Contributor‑level access or higher can insert malicious scripts into a page that will run whenever any user visits that page, potentially stealing credentials or performing other client‑side attacks.

The vulnerability affects the TR Timthumb WordPress plugin, specifically all releases up to and including version 1.0.4. Sites running any of these versions and permitting Contributor or higher roles are at risk.

The CVSS score of 6.4 indicates a moderate risk, while the EPSS score of less than 1 % suggests that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor level or higher; from that position an attacker can inject scripts that execute in every visitor's browser, compromising confidentiality, integrity, and potentially availability of the affected site.