This vulnerability is a classic CWE‑79 Stored Cross‑Site Scripting flaw. Malicious input can be injected into the plugin’s output and later rendered in the browser of any visitor who loads affected content. An attacker can use this to deface the site, steal session cookies, hijack user accounts, or perform additional malicious actions from within the victim’s session. The flaw stems from improper neutralization of user‑supplied data during web page generation.

WordPress sites that have installed the Gallery and Lightbox plugin from Oğulcan Özügenç, with any version up to and including 1.0.14. No further version restrictions are listed in the advisory, so all releases in that range are vulnerable.

The CVSS score of 6.5 marks it as moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in current threat landscapes. The vulnerability is not present in the CISA KEV catalog. The attack vector is inferred to be through the plugin’s web interface where user input is stored and later displayed—typical of stored XSS. A remote attacker, with access to the WordPress administration interface or any public form that feeds into the plugin, can supply malicious payloads that will be served to all site visitors.