Improper neutralization of input during web page generation in the Pixelgrade Category Icon plugin allows a stored cross‑site scripting (XSS) vulnerability. A malicious actor can inject client‑side script that will be executed when any user views a page containing the stored payload, potentially leading to cookie theft, session hijacking, or site defacement.

The vulnerability affects the Pixelgrade Category Icon plugin for WordPress, versions from the initial release up through 1.0.2. Any WordPress site that has installed a vulnerable version of this plugin is susceptible to the stored XSS flaw.

The CVSS score of 5.9 indicates a moderate risk, while the EPSS score of <1% suggests a low probability of exploitation at present. The vulnerability is not recorded in the CISA KEV catalog. Based on the nature of the flaw – stored XSS – the likely attack vector is a web‑based one where an attacker submits malicious script through the plugin’s input fields, which is then rendered to users who view the affected content. Exploitation would require access to the plugin’s input channels but does not need privileged system access.