The Categories Images WordPress plugin (up to version 3.3.1) contains a stored cross-site scripting vulnerability (CWE-79) via the 'z_taxonomy_image' shortcode. The vulnerability occurs because the shortcode processing path passes attacker-controlled input from the 'class' attribute into an HTML fallback image builder without proper escaping or sanitization. This allows authenticated users with Contributor-level privileges or higher to inject arbitrary JavaScript code that is stored and later executed in the context of users viewing the affected page. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, user interaction needed, and partial impact on confidentiality and integrity.

An attacker with Contributor-level access or higher can exploit this vulnerability to inject and store malicious scripts that execute in the browsers of users who view the affected pages. This can lead to partial compromise of confidentiality and integrity of user data within the affected site context. There is no reported impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Categories Images plugin if feasible. Monitor for updates from the plugin vendor to apply any forthcoming patches promptly.