The Image Hotspot by DevVN plugin for WordPress contains a stored cross‑site scripting flaw that allows an authenticated author or higher to inject arbitrary JavaScript via the hotspot_content custom field meta. The injected script is persisted in the database and executed whenever a page that contains that hotspot is rendered, enabling client‑side code execution. Potential consequences include session hijacking, cookie theft, defacement, or redirection to malicious sites, limited to users who view an injected page after the author’s credentials are compromised or used.

Affected systems are installations of the WordPress Image Hotspot by DevVN plugin, version 1.2.9 and earlier, published by levantoan. No other vendors or product versions are listed.

The CVSS score of 6.4 classifies the issue as medium severity, but the EPSS score is below 1% and the vulnerability is not currently listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. Attackers would need author or higher‑level access to the WordPress site to log in and insert malicious content, after which the script runs in the browser of any visitor who loads the affected page.