A stored cross‑site scripting flaw in the IGIT Related Posts With Thumb Image After Posts plugin allows an attacker who can inject content into the site to persist malicious scripts. These scripts run in the browsers of all users who view affected pages, potentially leading to credential theft, session hijacking, defacement, or other malicious actions. The vulnerability is a classic example of CWE‑79: Improper Neutralization of Input During Web Page Generation.

The weakness exists in phpaddicted’s IGIT Related Posts With Thumb Image After Posts plugin for WordPress, affecting all releases through version 4.5.3. No other products are listed.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, implying no known targeted exploitation. The likely attack vector requires the ability to insert or modify content via the plugin’s input fields or post editing interface; it is inferred that an authenticated user or an attacker who can inject content through the website’s admin interface could exploit it.