An improperly neutralized input in the Gijo Varghese Flying Images plugin permits stored cross‑site scripting, meaning that data entered through the plugin can be rendered in a web page without proper sanitization. The flaw allows an attacker to inject JavaScript that is executed in the browsers of site visitors, potentially leading to session hijacking, defacement, or phishing scams. This weakness is a classic stored XSS amplification of the plugin’s input handling, classified under CWE‑79.

The vulnerability affects all WordPress sites that use the Flying Images plugin version 2.4.15 or older. Versions from the initial release up to and including 2.4.15 are susceptible. Site administrators using Gijo Varghese’s Flying Images component should verify their plugin version and plan an upgrade.

With a CVSS score of 7.1, the flaw is considered high‑severity. The EPSS score is not available, but the exploitation potential remains significant due to the stored XSS nature. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can likely exploit the flaw via the plugin’s image upload or metadata fields when an authenticated or unauthenticated user includes malicious code that gets saved and displayed to other users. The damage is limited to the affected site, but the impact on user trust and potential data theft is substantial.