The WPBean WPB Image Widget plugin suffers from a stored XSS vulnerability due to improper input sanitization during web page generation. This flaw allows an attacker with low privileges to inject malicious scripts that execute in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability affects all versions up to 1.1. No official patch or fix has been documented at this time.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of authenticated users, potentially resulting in partial disclosure of information, modification of data, or disruption of service. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively but combined to a medium severity overall.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's administrative functions and monitor for suspicious activity. Avoid installing or using the affected versions of the WPB Image Widget plugin if possible.