The Easy Image Display plugin for WordPress contains a stored cross‑site scripting flaw. An attacker able to submit image metadata can inject JavaScript that is later rendered when users visit the page. This can lead to defacement, cookie theft, or session hijacking, representing a moderate security risk. The weakness is a classic stored XSS (CWE‑79).

Affected systems are WordPress sites that have the Shellbot Easy Image Display plugin installed in any version up to and including 1.2.5. No specific release is excluded beyond the 1.2.5 threshold.

The CVSS score of 6.5 indicates a moderate impact, while the EPSS below 1% shows a low likelihood of exploitation in the wild. The vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires an attacker to be able to inject content via the plugin's image metadata fields, which may only be possible for users with permission to upload or edit images. If user roles allow arbitrary input, an attacker can deliver malicious payloads that are executed in the browsers of all visitors to the affected page.