Improper neutralization of input during web page generation allows an attacker to inject malicious scripts that are reflected back to the victim’s browser. This reflected XSS flaw can compromise user credentials, perform session hijacking, or deface the website, violating confidentiality and integrity. The vulnerability is classified as CWE-79, a common client‑side injection weakness.

The BVD Easy Gallery Manager plugin for WordPress, versions up to and including 1.0.6, is affected. Any installation of the plugin within this version range is susceptible to exploitation.

The CVSS score of 7.1 indicates moderate to high severity, while an EPSS score of less than 1% suggests a low current exploitation probability. The flaw exists in a reflected manner and would typically be triggered when a victim visits a crafted link or interacts with the plugin’s interface. The vulnerability is not listed in the CISA KEV catalog, but administrators should treat it as a significant risk due to the potential damage from XSS.