The WP Photo Sphere plugin contains a stored cross‑site scripting flaw due to insufficient input sanitization during page rendering. Data entered by users, such as photo descriptions or metadata, is persisted unchanged; when a photo page is viewed, any injected JavaScript is executed in the visitor’s browser. This flaw enables an attacker to run arbitrary scripts within the context of the site’s front‑end, potentially exposing or manipulating client‑side data.

All installations of the WP Photo Sphere plugin by Jeremy that are version 3.8 or earlier are affected, as the vulnerability applies to all releases from the initial version through the stated maximum 3.8.

The CVSS score of 6.5 places the issue in the medium severity range. An EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an adversary to insert malicious JavaScript into a photo’s metadata, which is then stored and rendered when any user accesses the affected photo page. Once the vulnerable page is loaded, the embedded script runs with the privileges of the site's front‑end environment.