The Menu Icons by ThemeIsle plugin for WordPress has a stored cross‑site scripting vulnerability. The flaw lies in the handling of the ‘_wp_attachment_image_alt’ post meta field, where input is not properly sanitized or escaped. Attacks require authenticated access with Author‑level permissions or higher, and allow the attacker to inject arbitrary web scripts that will execute whenever a page containing that media metadata is loaded by a user.

All WordPress installations that have the Menu Icons by ThemeIsle plugin version 0.13.20 or older, and where the plugin is active, are affected. Sites that allow Author or higher privileged users to upload media or modify the alt text field are at risk.

The CVSS score of 6.4 reflects a moderate severity for this stored XSS flaw. The EPSS score of less than 1% indicates a currently low probability of exploitation. Because the vulnerability requires authenticated access, the attack surface is limited to sites where an attacker can compromise or obtain a user account with Author or higher privileges. The flaw is not listed in the CISA KEV catalog, but any attacker who manages to exercise the required privileges can inject malicious JavaScript that will run in the browsers of visitors to the affected page.