The vulnerability in the NGG Smart Image Search plugin allows improper neutralization of input during web page generation, leading to a stored cross‑site scripting (XSS) flaw. An attacker can inject malicious script that is persisted by the plugin and executed in the browsers of any user viewing the affected content. This can result in session hijacking, defacement, or theft of sensitive data due to the persistence of the payload.

The flaw affects the wpo‑HR NGG Smart Image Search plugin for WordPress, specifically all versions from the earliest available build up to and including version 3.3.3. Users of any WordPress installation running a vulnerable edition of this plugin are potentially impacted.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is the web interface where users can submit or store content that the plugin does not properly sanitize. Exploitation would require placement of malicious payload in a field that persists in the database, which is then rendered in future page views. Given these conditions, an attacker with access to the content entry points could achieve the stored XSS attack.