The Photographers galleries plugin fails to sanitize or escape several shortcode attributes such as w, h, raw_css, look, and others. An authenticated contributor or higher can insert arbitrary JavaScript into these attributes. When a user subsequently views a page that contains the injected shortcode, the script runs in that user’s browser, enabling attackers to hijack sessions, steal credentials, or deliver malicious payloads. The flaw is a classic stored XSS (CWE‑79).

All WordPress sites running Photographers galleries version 1.1.8 or earlier are vulnerable. The issue does not affect later releases of the plugin. Any installation that has enabled shortcodes with the affected attributes is susceptible, regardless of WordPress theme or other plugins.

The CVSS score of 6.4 reflects a moderate severity: authentication is required (contributor or higher) and the impact is confined to the browsers of users who view the compromised page. The EPSS score of less than 1% suggests that exploitation is currently unlikely in the wild. The vulnerability is not marked in the CISA KEV catalog. An attacker who can gain contributor rights can inject persistent code via the shortcode, leading to cross‑site scripting that may be used for phishing, malware delivery, or defacement. Mitigation is straightforward once a fix is applied, but until then sites remain at risk for active attackers with contributor privileges.