The Dream Gallery plugin for WordPress contains a Cross‑Site Request Forgery flaw in its "dreampluginsmain" AJAX endpoint. The flaw arises from missing or incorrect nonce checks, enabling an unauthenticated attacker to force an administrator to submit forged requests. This can change plugin settings and inject malicious scripts that are then stored and executed on the site, resulting in classic stored Cross‑Site Scripting. The vulnerability is classified as CWE‑352.

WordPress sites that use the Dream Gallery plugin version 1.0 or earlier. The issue is tied to the plugin itself, not the core WordPress installation. Administrators of sites deploying these plugin versions are at risk.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% shows that the likelihood of exploitation is low at present, and the vulnerability is not listed in CISA KEV. Exploitation requires a user interaction from a site administrator who is lured into clicking a malicious link or otherwise triggering the forged AJAX request. If such a click occurs, the attacker can gain persistent script execution under the administrator’s privileges, which can lead to defacement, credential theft, or further compromise of the site.