The flaw is a reflected Cross‑Site Scripting vulnerability that permits a malicious user to inject arbitrary scripts into the page being viewed. When attackers supply crafted characters or code in a request handled by the Dreamstime Stock Photos plugin, the response contains that unsanitized input. The injected script can execute in the victim’s browser, potentially dumping session cookies, hijacking the user’s session, altering the page content or redirecting the user to phishing sites. The weakness is catalogued as CWE‑79 and represents an integrity and confidentiality threat that can be exploited purely through a web request.

The vulnerability is present in Dreamstime Stock Photos plugin versions up to and including 4.1, inclusive of the initial release. Any WordPress site that has installed the plugin with a version number of 4.1 or earlier is affected. No higher versions are known to be impacted.

The CVSS score of 7.1 indicates a moderate‑to‑high severity level. The EPSS score is listed as <1%, signifying a very low probability that this flaw is actively exploited at present. The vulnerability is not catalogued in the CISA KEV repository, suggesting no known large‑scale exploitation campaigns targeting it. Attackers would need only to send a crafted URL or request containing malicious script fragments to an affected site, making the attack vector remote and straightforward. Given the low exploitation probability, the risk is moderate, but organizations should still remediate promptly to avoid potential future exploitation.