The vulnerability is a stored XSS flaw that occurs when user input is not properly neutralized during page generation by the Image Widget plugin. Malicious code injected into the widget can be executed in the browsers of all visitors who view the affected page. Based on the description, the attacker could potentially steal credentials, deface the site, or execute further attacks in the context of the site.

WordPress sites that have the StellarWP Image Widget plugin installed, specifically versions up through 4.4.11. The vulnerability applies to all releases in that range and to any installation that uses the same code base prior to the fix.

The CVSS v3.1 score of 5.9 indicates a medium severity. The EPSS score is below 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors include any user who can supply input to the widget interface—most commonly an authenticated administrator or author—after which the malicious script is persisted and executed for all visitors of any page displaying the widget.