The vulnerability in the Sirv CDN and Image Hosting plugin allows an attacker to perform stored Cross‑Site Scripting by injecting malicious input that is not properly neutralized before rendering in web pages. This can result in arbitrary script execution in the browsers of any user who views content processed by the plugin. The impact includes potential data theft, session hijacking, and defacement of sites that rely on the affected plugin.

Sirv CDN and Image Hosting: Sirv Plug‑in versions up to 7.5.3 are affected. Any WordPress installation using these versions is at risk.

The CVSS score of 6.5 indicates a moderate severity. With an EPSS score of less than 1%, the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by inserting malicious content into fields managed by the plugin, which is then stored and served to visitors. The attack vector is likely via the plugin’s input mechanisms, requiring the attacker to inject data that results in a rogue script being executed when a page is rendered.