Improper neutralization of input in the Categories Images plugin permits a DOM‑Based XSS flaw. An attacker can embed malicious JavaScript that executes in a victim’s browser when the victim visits a page that includes the vulnerable plugin. The impact is the ability to run arbitrary scripts in the context of the site, potentially enabling data theft, session hijacking, or the delivery of further malware.

The vulnerability affects all releases of the Categories Images plugin up to and including version 3.3.1. The plugin is maintained by the vendor Zahlan.

No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. However, XSS vulnerabilities are widely exploitable through crafted URLs or input fields. The attack requires user interaction on the vulnerable site, but once executed it can compromise confidentiality, integrity, and availability of the affected WordPress installation.