The NGG Smart Image Search plugin has an improper neutralization of input during web page generation, allowing stored XSS. The flaw permits attacker‑supplied scripts to be embedded in stored data that is later rendered, causing the script to execute in anyone’s browser that views the affected page.

The vulnerability affects wpo‑HR NGG Smart Image Search plugin version 3.4.3 or earlier. Every WordPress installation that has this plugin up to that version is potentially vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS < 1 % indicates a low likelihood of exploitation at this time, and the issue is not listed in the CISA KEV catalog. The likely attack vector is user‑controlled input that is stored and later displayed; an attacker would need to inject malicious payload through the plugin’s input fields and then have a victim load a page containing that payload.