The vulnerability is a stored cross‑site scripting flaw caused by insufficient input sanitization. Malicious input provided via the Featured Image from URL plugin can be embedded into web pages and executed in the browsers of site visitors. An attacker could inject JavaScript that steals session cookies, defaces the site, or redirects users to phishing pages, thereby compromising confidentiality, integrity, and availability of the compromised website.

The flaw affects the WordPress plugin Featured Image from URL, distributed by fifu.app. All released versions from the initial availability through version 6.1.4 are vulnerable. WordPress sites that have installed any of these versions are at risk.

The vulnerability carries a CVSS score of 7.1, indicating a high severity level. No EPSS score is available, so the exploitation probability is unknown. This issue is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker submitting malicious input via the plugin’s image URL field, which is then stored and later rendered without proper sanitization. Once a victim views the affected page, the injected script runs in the victim’s browser, providing the attacker with potential client‑side control.