The vulnerability is an improper neutralization of user input during web page generation, allowing reflected cross‑site scripting on the Easy Gallery plugin. This flaw lets an attacker inject arbitrary JavaScript into a page viewed by a victim, which can be used to steal session cookies, hijack a user session, deface content, or conduct other malicious actions in the context of the user’s browser. The weakness is classified as CWE‑79.

The affected system is the WordPress Easy Gallery plugin developed by OdiHost, version 1.4 and all earlier releases. No specific patch version is listed as fixed, but the impact statement indicates that any version up to and including 1.4 is vulnerable.

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors involve a user visiting a crafted URL or link that injects malicious JavaScript into the page generated by the Easy Gallery plugin. An attacker must rely on the victim’s browser to execute the payload, so the threat depends on user interaction but can lead to significant compromise of user sessions and site integrity.