The Image Source Control Lite – Show Image Credits and Captions plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) via the 'path' parameter. This occurs because the plugin does not properly neutralize input during web page generation, allowing injection of arbitrary scripts. The vulnerability affects all versions up to and including 2.28.0. Exploitation requires user interaction (clicking a malicious link) and does not require authentication. The CVSS 3.1 base score is 6.1, indicating a medium severity impact with low confidentiality and integrity impact and no availability impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session when the victim clicks a crafted link. This can lead to theft of sensitive information accessible via the browser, session hijacking, or other client-side impacts. There is no indication of direct impact on server availability or integrity beyond the client-side effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking untrusted links that reference the vulnerable 'path' parameter in the plugin. Monitoring for updates from the plugin vendor or WordPress plugin repository is recommended to apply any forthcoming patches promptly.