The Category Featured Images plugin contains a stored cross‑site scripting flaw that allows attackers to inject malicious scripts into the site’s data store. Improper neutralization of user input when generating web pages leads to arbitrary JavaScript execution in browsers of visitors who load affected pages. The identified weakness is CWE‑79.

All WordPress sites that use the Mat Category Featured Images plugin version 1.1.8 or earlier are affected. Any installation of the plugin prior to an update that removes this flaw is at risk.

The CVSS score of 5.9 indicates a moderate severity; the EPSS score is under 1%, suggesting exploit attempts are infrequent, and the vulnerability is not listed in CISA's KEV catalogue. The flaw is a stored XSS vulnerability: to exploit it, an attacker must first insert malicious code via the plugin’s content creation or editing interface (the likely attack vector, inferred from the description). Once injected, any visitor who loads the affected page will execute the script in the browser context.