The vulnerability is an improper neutralization of user input that allows stored cross‑site scripting in the WPMU DEV Smush Image Compression and Optimization WordPress plugin. An attacker that can influence content handled by the plugin can inject JavaScript that will be executed in the browsers of visitors to the affected site. The weakness is classified as CWE‑79, a classic input‑validation flaw that compromises the confidentiality and integrity of the web application by allowing arbitrary script execution.

The issue affects the WPMU DEV Smush Image Compression and Optimization plugin, from the earliest versions through 4.3.5. Any WordPress site that has the Smush plugin installed at a version equal to or older than 4.3.5 is potentially affected.

The CVSS score of 6.5 indicates a medium severity risk. The EPSS score is not available, so the current probability of active exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is a stored XSS that can be triggered by injecting malicious input via the plugin’s admin pages or media upload interface. Once an attacker decodes the side‑channel, they can execute arbitrary JavaScript in the browsers of visitors to the affected site.