The plugin permits arbitrary web scripts to be stored in the Image Source field. An attacker with Author level or higher can inject malicious code that will be executed in the context of any user viewing the affected page, potentially allowing credential theft, defacement or further code execution. The vulnerability stems from insufficient input sanitization and output escaping, classified as CWE‑79. The CVSS score of 6.4 indicates a moderate severity level.

WordPress sites that have the Image Source Control Lite – Show Image Credits and Captions plugin installed, versions up to and including 3.9.1. The vulnerability is present in all legacy releases of the plugin and is not limited to a single minor version.

Exploitation requires an authenticated session with Author or higher privileges and access to the Image Source editing interface. Once the script is stored, it automatically triggers for each visitor who loads pages that reference the edited image, making it a classic stored XSS scenario. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the moderate CVSS score implies that it is a credible threat especially on sites with high traffic and without additional mitigations such as a strict Content Security Policy.