The BJ Lazy Load WordPress plugin contains a stored cross‑site scripting flaw in its image filtering routine. A crafted value inside a class attribute can be parsed, causing the content to become a real DOM attribute after the PHP regex replacement. An attacker with at least Contributor level can insert arbitrary JavaScript that will run when any user views the affected page. This allows client‑side code execution, potentially enabling cookie theft, session hijack, defacement or phishing attacks.

WordPress sites that use the BJ Lazy Load plugin, versions 1.0.9 and earlier are affected. The flaw resides in the plugin’s filter_images() function and applies to all installations of the vendor product ‘BJ Lazy Load’ that have not been patched beyond 1.0.9.

The CVSS score is 6.4, indicating a medium severity vulnerability. EPSS data is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor-level privileges, making the attack vector local to the CMS user. Because the exploit injects persistent scripts into page content, any visitor to the compromised page can be exposed to the injected code. The medium CVSS score combined with the authenticated attack vector suggests that the risk is present but lower than remote code execution; however, the availability of many Contributor accounts in typical WordPress installations means the vulnerability is still actionable.