The Image Editor by Pixo WordPress plugin suffers from a stored XSS vulnerability (CWE-79) via the 'download' parameter. Authenticated attackers with Contributor or higher privileges can inject arbitrary web scripts due to improper input neutralization during page generation. This vulnerability affects all plugin versions up to 2.3.6 and can lead to script execution in the context of users visiting the injected pages. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact.

Successful exploitation allows authenticated users with Contributor-level access or above to inject persistent malicious scripts into pages. These scripts execute in the browsers of users who view the compromised pages, potentially leading to unauthorized actions such as session hijacking or data manipulation. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher privileges to trusted users only. Consider implementing additional input validation or output escaping at the application or web server level as a temporary mitigation.