CVE-2025-24707

WordPress Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.24 - Reflected Cross Site Scripting (XSS) vulnerability

View on CVE.org
Published Feb 3, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.24.

Analysis

AI-generated

Technical impact

The vulnerability in gt3themes Photo Gallery enables an attacker to inject malicious scripts that execute when a user views a gallery page. This reflected XSS flaw can allow an attacker to hijack user sessions, deface the site, or exfiltrate sensitive data. The weakness is the lack of proper escaping when user input is reflected in generated HTML, identified as CWE‑79.

Affected Systems

WordPress sites using the gt3-photo-video-gallery plugin in versions up to and including 2.7.7.24 are affected. The plugin is developed by gt3themes under the Photo Gallery product line.

Risk and Exploitability

The CVSS score of 7.1 denotes a medium‑severity vulnerability. The EPSS score of less than 1% suggests that, at the time of assessment, exploitation frequency is very low, and the flaw is not catalogued in CISA's KEV list. Exploitation would typically require the attacker to craft a URL or embed malicious input in gallery parameters that the plugin fails to sanitize before rendering.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest version of the gt3-photo-video-gallery plugin (2.7.7.25 or newer) which removes the XSS flaw.
  • If an upgrade is not immediately possible, deactivate or uninstall the plugin to eliminate the vulnerability until a patched version is available.
  • Enable a Web Application Firewall or apply a strict Content Security Policy to block reflected XSS payloads on gallery pages.

Generated by OpenCVE AI on May 2, 2026 at 04:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-3899 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3 Photo Gallery Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery allows Reflected XSS. This issue affects Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery: from n/a through 2.7.7.24.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3 Photo Gallery Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery allows Reflected XSS. This issue affects Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery: from n/a through 2.7.7.24. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.24.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Metrics epss

{'score': 0.00035}

 epss

{'score': 0.00045}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3 Photo Gallery Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery allows Reflected XSS. This issue affects Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery: from n/a through 2.7.7.24.
Title WordPress Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.24 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Jan 23, 2025, 2:52 PM

View source JSON

Updated
Feb 3, 2025, 4:06 PM

JSON

Status
Deferred
Published
Feb 3, 2025, 3:15 PM
Modified
Jun 17, 2026, 8:59 AM

View source JSON

No data.

Updated
May 2, 2026, 5:00 AM

JSON