The vulnerability is a stored Cross‑Site Scripting flaw in the Babar prettyPhoto WordPress plugin caused by improper neutralization of input. An attacker can inject malicious script that is persisted and later rendered in the browser of any user who views the affected content, potentially allowing data theft, session hijacking, defacement or further attacks. This is a classic CWE‑79 weakness that affects confidentiality, integrity, and availability of end-user sessions.

The affected product is the WordPress prettyPhoto plugin released by Babar. Versions from the earliest available release through 1.2.5 are vulnerable. Anyone using this plugin on a WordPress site should verify the installed version and upgrade if possible.

The CVSS base score of 6.5 indicates moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis, and the issue is not listed in the CISA KEV catalog. The typical attack vector is through normal web input to the plugin’s interface, where a malicious user can submit script‑laden content that is later rendered for all site visitors. Because the payload is stored, once the site is compromised, the vulnerability persists until the plugin is updated or removed.