The Image Switcher plugin contains an improper input neutralization flaw that allows an attacker to inject malicious scripts that are stored and subsequently rendered within WordPress pages. This Stored XSS vulnerability, categorized as CWE‑79, permits an attacker to execute arbitrary JavaScript in the browsers of site visitors, potentially leading to session hijacking, data theft, defacement, or redirection to malicious sites.

WordPress sites using the KHAN‑IT Image Switcher plugin version 1.1 or earlier are impacted. The issue applies to all installations that have not upgraded beyond the stated version threshold.

The CVSS score of 6.5 indicates medium severity. An EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user or a site administrator adding or editing content that the plugin stores and later displays, as the stored payload is rendered without proper sanitization.