The WP ImageViewer plugin contains a stored DOM‑based XSS flaw that occurs when the alt attribute of an image is populated with unsanitized input. Because the plugin fails to escape the value before rendering, an attacker who can create or edit image content can embed arbitrary JavaScript that will run in the context of any visitor who loads the affected page. The attack requires authenticated access with Subscriber privileges or higher, and depends on the presence of a front‑end content plugin (e.g. bbPress) that grants the Subscriber role the bbp_participant capability.

Any WordPress site that has the WP ImageViewer plugin installed, versions 3.0.2 or older, is affected. The vulnerability is active whenever the plugin is activated and an alt attribute value is stored in the WordPress database. Attackers with Contributor or higher privileges can also exploit the flaw on sites that allow image HTML in post content, which is enabled by default in WordPress. Sites that restrict such submission to custom roles must still consider that role or higher can contain the payload.

The flaw carries a CVSS score of 6.4, indicating moderate severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation is limited to authenticated users, and requires that the target site allows content submission with image tags or that a compatible front‑end plugin is installed. Once an injection is recorded, any user who views the page will have the attacker‑supplied script executed in their browser, potentially enabling session hijacking, credential theft, or further site compromise.