The Easy Author Image plugin for WordPress stores user input from the author_profile_picture_url field without sufficient sanitization or escaping, allowing an authenticated user with Subscriber-level access or higher to place arbitrary JavaScript that will run in the browser of any visitor that opens the affected page. The vulnerability arises from the plugin’s failure to filter and escape this input before rendering it on profile pages.

Lawsonry’s Easy Author Image plugin, all releases through version 1.7, is affected. Any WordPress site that has installed this plugin in that range is vulnerable.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a very low likelihood of exploitation in the wild. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires an authenticated user with at least Subscriber role, a role that is widely available on WordPress sites, which could enable widespread impact if discovered and abused.