The ZoomifyWP Free plugin contains a flaw where the 'filename' attribute of the 'zoomify' shortcode is not properly sanitized or escaped, enabling an authenticated user with Contributor or higher privileges to store arbitrary scripts in post content. These scripts are executed in visitors’ browsers whenever the affected page is accessed.

WordPress installations that use Terrazoom's ZoomifyWP Free plugin version 1.1 or earlier are affected. The vulnerability exists in every instance of the plugin with those versions where contributors can add or edit post content.

The base CVSS score is 6.4, categorizing the issue as moderate severity. The EPSS score is less than 1 %, indicating a very low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with at least Contributor level access; once a malicious script is stored via the shortcode, it automatically executes for any visitor loading the affected page, making all site users vulnerable to the stored XSS content.