CVE-2026-2505 is a stored cross-site scripting vulnerability in the Categories Images WordPress plugin (versions up to 3.3.1). The issue arises because the 'z_taxonomy_image' shortcode processes attacker-controlled input in the 'class' attribute without proper HTML escaping, allowing injection of arbitrary scripts. This vulnerability requires authenticated access at Contributor level or above and results in script execution when users view the manipulated frontend page. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

Successful exploitation allows an authenticated user with Contributor-level permissions or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to session hijacking, defacement, or other client-side attacks. There is no indication of impact on confidentiality beyond limited user data exposure, nor impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Categories Images plugin if feasible. Monitor for updates from the plugin vendor or WordPress security channels for an official patch.