The plugin contains an improper neutralization of input during web page generation that allows an attacker to inject malicious script content which is then permanently stored in the site’s data. Once a visitor loads a page that renders the injected content, the attack can execute arbitrary JavaScript in the victim’s browser, potentially leading to credential theft, defacement, or propagation of malware. The weakness is identified as CWE‑79, a classic XSS flaw.

The vulnerability affects the WordPress Post List Featured Image plugin developed by Johnny. All releases from the first version (n/a) through version 0.5.9 are susceptible. Sites that have installed any of these affected versions are at risk.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. It is likely that an attacker could exploit the flaw via a web‑based attack vector, submitting malicious content to the plugin’s input fields. If stored, the payload would be delivered to every user who loads the compromised page.