The vulnerability in Easy Image Collage is a stored Cross‑Site Scripting flaw that allows an attacker with author or higher privileges to insert arbitrary JavaScript into the grid[properties][borderColor] and grid[images][N][attachment_url] fields. Because the plugin writes this data directly to the post meta table with update_post_meta(), the WordPress filtering that normally blocks unfiltered HTML for non‑administrator users is bypassed, permitting malicious code to be persisted and executed whenever any user views a page containing the affected collage.

The flaw affects all releases of the Easy Image Collage plugin up to and including version 1.13.6, manufactured by brechtvds.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score is not available. The vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires an authenticated user with author-level access (or higher) to create or edit a collage, after which arbitrary scripts will run in the browsers of any visitor to the affected page. Given the lack of automatic mitigation from WordPress’s unfiltered_html restriction, the risk is elevated for sites that allow authors to modify content.