The Category Icon plugin accepts user‑supplied XML and processes it without disabling external entity resolution. Because the flaw is a CWE‑611 XML External Entity issue, an attacker can define XML entities that reference arbitrary files or external resources. This can expose sensitive server files or cause the server to request external resources. The vulnerability primarily affects the confidentiality of server data.

WordPress sites that have the pixelgrade Category Icon plugin installed at version 1.0.3 or earlier. All releases up through 1.0.3 are vulnerable, including the first public release.

The CVSS score of 9.1 reflects a high‑severity flaw, and the EPSS of less than 1 % indicates that exploitation is not common. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the required attack vector is remote: an attacker can supply a crafted XML payload through inputs accepted by the plugin, such as admin settings or data imports. If the plugin runs with file system permissions, reading arbitrary files or retrieving external resources is possible. The risk remains high until the plugin is patched or disabled.