The Flying Images plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts via the plugin's admin settings, which are then stored and executed in the context of users visiting the injected pages. This vulnerability affects multi-site setups or installations with unfiltered_html disabled, increasing the risk of persistent script injection. The CVSS 3.1 score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

An attacker with administrator-level access can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed with the victim's privileges. The vulnerability does not affect availability and requires high privileges and a multi-site or restricted HTML configuration to be exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the Flying Images plugin in multi-site environments or where unfiltered_html is disabled. Monitor for plugin updates from the vendor addressing this vulnerability.