The Media Library Alt Text Editor plugin for WordPress processes the 'post_id' attribute of its "bvmalt_sc_div_update_alt_text" shortcode without adequate sanitization or escaping. This flaw permits authenticated users with contributor or higher privileges to embed malicious scripts that are then stored in the site’s content. When a visitor loads the affected page, the injected script executes in the context of that browser, exposing the user to session hijacking, data theft, or defacement. The issue is specifically a Stored Cross‑Site Scripting vulnerability characterized by CWE‑79.

WordPress sites running the Media Library Alt Text Editor plugin, version 1.0.0 and earlier. No patch release for versions beyond 1.0.0 is documented in the provided data. The plugin is distributed via the WordPress plugin repository and identified under the vendor brainvireinfo.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% implies a low likelihood of public exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only that an attacker is authenticated as a contributor or higher; no additional network or local privileges are needed. After authentication, the attacker can embed a single string in a post that will be rendered and executed on every subsequent view of that page, targeting all site users who have access to the page.