The Image Source Control Lite plugin has a vulnerability where it does not properly neutralize user input in generated web pages. The flaw permits reflected cross‑site scripting (XSS) when the plugin outputs user‑supplied data without adequate escaping. The designated CWE is 79, indicating that attackers can inject and execute arbitrary script on the rendered page.

The flaw is present in all releases of the Image Source Control Lite plugin up through version 2.29.0. Any WordPress installation that has the plugin installed at or below that version is affected.

The CVSS score is 7.1, indicating a high impact scenario, while the EPSS score of < 1% suggests a very low probability of exploitation at any given time. The vulnerability is not listed in the CISA KEV catalog. As a reflected XSS flaw, the exploitation typically involves delivering a crafted request that causes the plugin to reflect malicious script in the page output. This does not require privileged access on the host, but it relies on a victim visiting a URL or submitting data that triggers the vulnerable code path.