The affected WordPress plugin contains an input handling flaw that allows a malicious user to inject arbitrary JavaScript into the page output. The stored XSS can persist across sessions, enabling attackers to deface sites, manipulate page content, or steal session cookies from visitors. This weakness is a classic failure to neutralize input, directly mapping to the CWE‑79 classification and posing a significant integrity and confidentiality risk for any site that hosts the plugin.

WordPress plugins installed from author A. Jones named Featured Image Thumbnail Grid, any released version up to and including 6.8, are vulnerable. Users running these versions should be aware that the flaw is present until a newer release or proper sanitization is applied.

The CVSS score of 6.5 signals a moderate potential for damage, while the extremely low EPSS (<1%) indicates that the likelihood of exploitation is currently small. The vulnerability is not part of the CISA KEV catalog. Exploitation would typically involve an attacker who can submit content through the plugin’s input interface; once stored, the malicious script executes in the context of every user who views the affected page. The attack vector is likely local to the site’s administrative or content creation functions.