This vulnerability is a stored cross‑site scripting flaw in the imaGenius WordPress plugin. It allows HTML or script content supplied by a user to be stored and then rendered to other visitors without proper neutralization, as identified by CWE‑79. An attacker who can submit or modify site content can embed malicious code, which will execute in the browsers of any user who views the affected page, potentially leading to phishing, credential theft, or the execution of arbitrary commands. The likely attack vector is the plugin’s user‑generated content fields that are displayed without escaping.

The vuln affects the WordPress imaGenius plugin, developed by Eugenio Petulla. All versions through 1.7, including earlier releases (no particular minimal version is specified), are affected. The plugin is used to manage image galleries and other media content within WordPress sites.

The CVSS base score is 6.5, indicating a moderate severity. EPSS is less than 1%, suggesting a very low probability of exploitation in the wild at this time, and the weakness is not listed in the CISA KEV catalog. Nonetheless, the flaw is exploitable via a web interface that accepts content, meaning administrators should treat it with caution. An attacker’s success depends on having write access to plugin data or a way to inject content into the site, but once the payload is stored, any visitor will be impacted.