The Album and Image Gallery Plus Lightbox plugin is vulnerable to Stored Cross‑Site Scripting. An attacker with contributor level or higher can inject arbitrary JavaScript through the aigpl-gallery-album shortcode because the plugin does not sanitize user‑supplied attributes. When an affected page is viewed, the injected script runs in the victim’s browser, enabling actions such as cookie theft, session hijacking, defacement, or the execution of additional malicious payloads.

Affected vendors and products are essentialplugin's Album and Image Gallery Plus Lightbox. All releases up to and including version 2.1.7 are vulnerable. The issue manifests when the shortcode is used on WordPress pages or posts by an authenticated user. No other product versions are known to be impacted.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Because exploitation requires authenticated access at the contributor level, the attack surface is limited to content‑editing users. However, once the attacker injects malicious script, the impact can be substantial, affecting all visitors who later view the compromised page.