An authenticated user with Contributor or higher access can insert arbitrary JavaScript into the Gallery Block of WordPress pages. The injected code executes in the browsers of any visitor who views the affected page, enabling session hijacking, cookie theft, or other client‑side attacks. The vulnerability stems from insufficient input sanitization and output escaping, a classic instance of CWE‑79. The impact directly compromises confidentiality and integrity of users interacting with the compromised content.

The Gallery Styles plugin for WordPress, sold by kometschuh, is affected in all releases up to and including version 1.3.4. Any WordPress installation that has a vulnerable version of this plugin installed is at risk.

The vulnerability has a CVSS score of 6.4, indicating moderate risk. The EPSS score is below 1 %, suggesting a low probability of exploitation at present. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the Contributor level or higher, implying that the attacker must first gain or be granted such privileges on the site. Once authenticated, the attacker can inject scripts through the Gallery Block, which are then stored and served to all users who view the page.