An improper neutralization of input during web page generation, classified as Cross‑Site Scripting, was discovered in the WPBean WPB Image Widget plugin. This stored XSS flaw permits an attacker to inject arbitrary JavaScript into pages rendered by the plugin, potentially leading to defacement, credential theft or session hijacking of visitors who view affected pages. The weakness is identified as CWE‑79.

The vulnerability affects the WPBean WPB Image Widget plugin for WordPress. All releases from the initial version through version 1.1 are impacted.

The calculated CVSS score is 6.5, indicating a moderate severity. The EPSS score is less than 1 percent, suggesting a low probability of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, further indicating limited active exploitation. Likely exploitation requires an attacker with access to the WordPress administration interface or the ability to embed malicious content within the widget, which would then be served to unsuspecting site visitors.