This vulnerability is a DOM‑based Cross‑Site Scripting flaw in the Ickata Image Editor by Pixo plugin. Improper neutralization of input during web page generation allows an attacker to inject malicious scripts that execute in the victim’s browser. The impact is that an attacker can run arbitrary code, deface the site, steal cookies or session data, and perform other client‑side attacks.

The affected product is Ickata Image Editor by Pixo for WordPress, any release with a version number up to and including 2.3.8. No other vendors or product lines are listed.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1 % shows a very low probability of exploitation in the wild, and the vulnerability is not found in CISA’s KEV catalog. The flaw requires the victim to visit a page that loads the untrusted input into the DOM; therefore the attack vector is through the web interface of the plugin. An attacker can exploit the issue by crafting a URL or injecting a value that is rendered by the image editor page. Because it is DOM based, the vulnerability is triggered client‑side and can be bypassed by using any user‑facing entry point that passes data to the editor.