The Google Drive WP Media plugin contains an Improper Neutralization of Input during Web Page Generation flaw that enables stored XSS. The vulnerability is present in all releases up to and including version 2.4.4, allowing attackers to inject malicious scripts that execute in the browser context of any user who views the affected content. This can lead to credential theft, defacement, or further session hijacking.

Affected systems are installations of Moch Amir’s Google Drive WP Media plugin for WordPress, any version from the beginning of its availability through 2.4.4. The plugin integrates with the WordPress admin interface, so sites running these versions are at risk.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1% shows a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can likely exploit the flaw by submitting crafted content to the plugin’s stored fields, which are later rendered without proper escaping, causing the script to run in the context of site visitors. Preventive mitigation is therefore recommended.