Remote Images Grabber allows an attacker to inject scripts into the HTML page that is served to the visitor. The vulnerability arises from the plugin failing to escape user input when generating the page, which can result in an attacker executing arbitrary JavaScript in a visitor’s browser. This can compromise the victim’s session, steal credentials, or perform other malicious actions on the user’s behalf.

The flaw affects the WordPress plugin Remote Images Grabber shipped by the vendor andreyk. Any site running this plugin with a version through 0.6 (inclusive) is vulnerable. The CVE documentation does not list a baseline or minimum affected version, so all versions up to and including 0.6 are considered susceptible.

The CVSS score of 7.1 indicates a high severity, but the EPSS score of less than 1% signals that exploitation is currently unlikely to occur in the wild. The vulnerability is not listed in the CISA KEV catalog. It is most likely exploited by sending a crafted request that includes malicious parameters, causing the plugin to reflect the input verbatim in the response. The attacker would need the victim to visit a page that includes this reflected input in order for the malicious script to execute.