EIP-2026-113859

The exploit demonstrates a reflected XSS vulnerability in the Lazyest Gallery WordPress Plugin by injecting a malicious script via the 'image' parameter in lazyest-popup.php. The payload executes arbitrary JavaScript in the context of the affected site, allowing cookie theft or other client-side attacks.