The Image Editor by Pixo plugin for WordPress contains a stored cross‑site scripting flaw in the download parameter. Insufficient input sanitization and output escaping allow an authenticated user with Contributor level or higher to inject arbitrary JavaScript that will run whenever any user visits the injected page. This can facilitate credential theft, session hijacking, defacement, or distribution of malware, compromising site integrity and user trust.

The flaw affects the ickata Image Editor by Pixo plugin in all releases up to and including version 2.3.6. WordPress site owners using any of these versions are vulnerable. The issue resides in the Plugin’s frontend handling of download requests.

The CVSS score is 6.4, indicating moderate severity. EPSS is less than 1%, suggesting very low exploitation probability at present, and it is not listed in CISA’s KEV catalog. However, the vulnerability requires only an authenticated Contributor or higher, making it relatively easy to abuse once access is granted. The patch is available in newer plugin releases, and the attack vector is dominated by the download parameter that can be manipulated by users with sufficient role permissions.