The Category and Taxonomy Image WordPress plugin (versions ≤1.0.0) suffers from a stored XSS vulnerability via the '_category_image' parameter due to improper neutralization of input during web page generation. Authenticated users with editor or higher privileges can inject arbitrary JavaScript code that executes in the context of other users viewing the injected pages. This vulnerability affects multi-site WordPress setups or installations where unfiltered_html is disabled. The CVSS 3.1 base score is 5.5, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed.

An attacker with editor-level or higher permissions can exploit this vulnerability to inject malicious scripts into pages, potentially leading to unauthorized actions or data exposure when other users access those pages. The impact is limited to multi-site WordPress installations or those with unfiltered_html disabled. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level permissions carefully and consider limiting access to multi-site installations or disabling the vulnerable plugin. Monitor for updates from the plugin vendor or WordPress security advisories to apply any forthcoming patches promptly.