Stored Cross‑Site Scripting (XSS) exists in the Auto Thumbnails WordPress plugin due to unsanitized 'width' and 'height' attributes in the 'thumbnails' shortcode. An authenticated user with contributor privileges can insert malicious scripts that will execute whenever the affected page is loaded, potentially compromising session data, stealing information, or defacing content. This vulnerability corresponds to CWE-79, an input validation weakness.

The vulnerability impacts the Auto Thumbnails plugin from the vendor gapgag55, affecting all versions up to and including 1.0, which is installed on WordPress sites that have deployed this plugin.

The CVSS score of 6.4 indicates a moderate severity, and there is no EPSS score available to assess exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated contributor or higher access to create or modify content using the shortcode; after injection, the malicious script is stored and will run for any user who views the page, making the attack vector internal but broadly exploitable within the site.