The vulnerability is an improper neutralization of input during web page generation, allowing an attacker to inject arbitrary JavaScript that will execute in the context of a victim’s browser. This could lead to session hijacking, defacement, or other malicious actions performed while the user is authenticated. The weakness is a classic reflected cross‑site scripting scenario (CWE‑79).

The flaw affects the ImageMeta plugin from ERA404, versions up to and including 1.1.2. Users running any of these versions on a WordPress site are exposed; no other products or versions are impacted.

The CVSS score of 7.1 reflects a high‑severity weak point requiring attacker input. The EPSS score of < 1% suggests that exploitation likelihood is low at present, but the vulnerability is still exploitable without advanced skills. It is not listed in the CISA KEV catalog. Attacker exploitation is inferred to rely on craft a URL or input containing malicious payloads that the plugin fails to sanitize, which would then be echoed back in the HTML response to the victim. No prerequisite software or network conditions beyond normal web traffic are required.