Improper neutralization of input during web page generation in the WordPress Random Image Selector plugin allows attackers to embed malicious scripts into page output. The injected code is executed in the victim's browser within the context of the site, potentially enabling client‑side data theft or other harmful actions. Based on the description, it is inferred that an attacker can embed malicious scripts into parameters that the plugin reflects, resulting in client‑side script execution in the browser.

The vulnerability exposes WordPress installations that use the Random Image Selector plugin by kdmurray to XSS attacks through any version up to and including 2.4. The 1.5.6 release is specifically mentioned as vulnerable; any installation using that or older versions is affected.

The CVSS score of 7.1 indicates high severity for client‑side attacks. An EPSS score of less than 1% shows a low likelihood of exploitation in the wild. The vulnerability is not tracked in CISA's KEV catalog. Exploitation typically requires the victim to visit a crafted URL or interact with the affected plugin, making it a standard reflected XSS scenario.