The Photospace Responsive plugin contains a stored cross‑site scripting flaw caused by inadequate output escaping, permitting an attacker to inject malicious JavaScript that is later displayed to visitors of the website.

The vulnerability affects the WordPress Photospace Responsive plugin provided by THRIVE – Web Design Gold Coast. All releases up to and including version 2.2.0 are impacted, so any WordPress site running an affected version is at risk.

The CVSS score of 5.9 indicates moderate severity, while an EPSS score of < 1 % suggests a very low likelihood of exploitation in the wild; the flaw is not listed in the CISA KEV catalog. The likely attack vector involves an attacker submitting crafted input through the plugin’s content entry fields that is stored and subsequently rendered; this requires the ability to add or modify content via Photospace Responsive. Once the payload is stored, it executes in the browsers of all visitors who load the affected pages.