The vulnerability allows an authenticated user with Contributor or higher privileges to inject arbitrary JavaScript into a page by abusing the 'class' attribute of the z_taxonomy_image shortcode; when any visitor later views that page, the injected script executes, potentially stealing session data, defacing content, or facilitating phishing attacks. This is a classic Injection flaw under CWE‑79 and carries a CVSS base score of 5.4, reflecting moderate risk.

The issue affects the Categories Images plugin for WordPress, version 3.3.1 and earlier, released by elzahlan. Sites running these versions should verify they are using a release newer than 3.3.1 for a fix.

An attacker only needs Contributor‑level access, which is permissive on many WordPress sites, to place malicious code in the content database. The stored nature of the flaw means the script remains present until removed, exposing every site visitor to the risk. There are currently no documented exploits, and the EPSS score of < 1% indicates a very low probability of exploitation. The CVSS score of 5.4 reflects moderate severity, and the vulnerability is not listed in the CISA KEV catalog at this time.