The WP AD Gallery plugin for WordPress suffers from insufficient input sanitization and output escaping on the startindex parameter of the ad‑gallery shortcode. This flaw enables an authenticated attacker who possesses contributor‑level access or higher to inject arbitrary JavaScript code. When other users view a page that contains the malicious shortcode, the injected script runs with the victim’s browser context.

All WordPress installations that use WP AD Gallery version 1.3 or earlier are affected. The vulnerability exists in every release up to and including 1.3 and is present across all platforms that support the plugin, such as sites hosted on shared or dedicated WordPress environments.

The CVSS score of 6.4 represents a moderate severity; the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with at least contributor privileges to exploit this issue. Once authenticated, the attacker can submit a crafted startindex value, resulting in stored cross‑site scripting that affects any user who afterwards visits the injected page. Because the flaw is stored, the malicious content persists until the shortcode is removed or the plugin is upgraded.