The vulnerability is a stored cross‑site scripting flaw in the title field of the Filterable Portfolio Gallery plugin. When an authenticated user enters a malicious payload—such as a JavaScript‑enabled image tag—into the title, the code is stored in the database and later executed when the gallery is previewed. This flaw is a classic example of CWE‑79, allowing attackers to inject arbitrary client‑side scripts that run in the browsers of all visitors to the affected galleries.

WordPress sites that have the Filterable Portfolio Gallery plugin 1.0 installed are impacted. The flaw exists in the plugin’s title field handling and requires the installer to be an authenticated user with permission to update the gallery items. Any WordPress installation using this plugin version is susceptible.

The CVSS score of 5.1 indicates a medium severity risk. An attacker must have authenticated access to the admin interface, but once the payload is stored it impacts every visitor viewing the gallery, enabling code execution in their browsers. The EPSS score is not available and the vulnerability is not listed in KEV, suggesting that while the flaw is known, there is no current evidence of widespread exploitation. The risk is elevated by the broad audience of gallery pages and the potential for data theft or session hijacking through the injected code.