The Category Image plugin is vulnerable to stored cross‑site scripting through the tag-image parameter. Due to insufficient input sanitization and lack of output escaping, authenticated users with Editor rights or higher can inject arbitrary JavaScript. When an affected user views the page, the injected script runs in the browser, potentially allowing credential theft, session hijacking, or defacement. The weakness is a classic user‑input injection flaw (CWE‑79).

WordPress sites that have installed the Category Image plugin version 2.0 or earlier are affected. All installations that use the plugin’s tag-image functionality can be exploited. Users with WordPress roles at Editor level or above are required to inject the payload.

The vulnerability has a CVSS score of 4.4, indicating moderate severity. Exploit probability is very low (EPSS < 1%) and it is not listed in CISA KEV, suggesting it is not currently known to be actively exploited. Attack requires legitimate WordPress credentials with Editor privileges and involves submitting malicious content via the tag-image field; the attack vector is inherent to the plugin’s functionality rather than network‑level exploitation.