Improper Neutralization of Input During Web Page Generation, or stored XSS, exists in PhotoShelter for Photographers Blog Feed Plugin through version 1.5.7. The flaw allows an attacker to inject malicious script that is persisted in the site’s data store and executed when other users view the affected content. In a typical scenario the injected code runs with the privileges of the victim user, enabling cookie theft, session hijacking, defacement, or the delivery of further malware.

Supplied by the vendor PhotoShelter, the plugin is available for WordPress installations that support the PhotoShelter for Photographers Blog Feed feature. Versions from the initial release up through and including 1.5.7 are affected. No exact minimum version is specified, so all historical releases of the plugin licensed from PhotoShelter are presumed vulnerable until a patch is applied.

The CVSS score of 6.5 points to a medium severity attack. The EPSS score is below 1%, indicating a low expected exploitation rate, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is likely remote and depends on the ability to provide compromised input via the plugin’s feed interface, which can then propagate to users who view or interact with the stored content.