The WP‑PhotoNav plugin allows authenticated users with contributor or higher roles to insert the photonav shortcode with arbitrary attributes, and the plugin fails to properly sanitize or escape the supplied values. This stored cross‑site scripting flaw, identified as CWE‑79, lets an attacker embed malicious scripts in posts or pages that execute whenever any user views the affected content. The consequences could include session hijacking, defacement, or delivery of malware to site visitors.

The vulnerability exists in all releases of the WP‑PhotoNav plugin for WordPress up to and including version 1.2.2. Users running this plugin, regardless of WordPress version, are potentially affected.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation under normal circumstances. The flaw is not yet catalogued in the CISA KEV list. Exploitation requires the attacker to possess contributor‑level or higher authorisation and to be able to create or edit content that contains the photonav shortcode; no external trigger or vulnerability in WordPress core mitigates this.