A stored cross‑site scripting flaw exists in the ThickBox 3.1 JavaScript library bundled with several WordPress plugins. Insufficient input sanitization and output escaping allow an authenticated user with contributor‑level or higher access to inject arbitrary JavaScript into plugin content. When the affected page is loaded by any visitor, the injected script executes in the visitor’s browser, potentially hijacking sessions, defacing the site, or delivering further malicious payloads. This weakness is categorized as CWE‑79.

The vulnerability is present in multiple WordPress plugins that bundle ThickBox 3.1, including Auto Thickbox by denis‑de‑bernardy, NextGEN Gallery by smub, and the YouTube Embed, Playlist and Popup suite by wpdevart. All affected plugins use the same bundled library and share the same flaw. No specific version range is publicly listed beyond "various versions," so any installation of these plugins that has not been updated to a patched release is considered vulnerable.

The CVSS score of 6.4 indicates moderate severity, while the EPSS value of <1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because the exploit requires authenticated WordPress contributor or higher privileges, the initial attack surface is limited to the site’s own administrators, but once an attacker injects code it can affect all visitors who load the compromised page. Organizations should treat this as a moderate‑risk issue that warrants prompt remediation.