The vulnerability allows an attacker who is logged in with contributor‑level or higher privileges to inject arbitrary JavaScript into pages via the prettyPhoto JavaScript library bundled with several WordPress image and media plugins. The flaw arises from insufficient sanitization and escaping of user‑supplied attributes; when a malicious value is stored, it is rendered unescaped on subsequently visited pages, causing the script to run in the context of the victim’s browser. This can lead to cookie theft, session hijacking, defacement or the deployment of further malware. The risk is confined to users who access the affected pages after the injection, but since any site visitor could be targeted, the impact can be widespread.

Affected plugins include Devrix Easy Image Gallery, Fuzzoid Easy 3‑D Viewer, Nayon46 Awesome WP Image Gallery, Raihan CSE Awesome Gallery, and WpTipsnTricks WP Video Lightbox. Each of these plugins in various versions incorporates prettyPhoto 3.1.6, which contains the unprotected input handling that enables the stored XSS. No specific version ranges were provided, but the vulnerability applies to all releases that ship the unpatched prettyPhoto library.

The CVSS score of 6.4 indicates a moderate severity, with an EPSS score of less than 1% and no listing in the CISA KEV catalog. Even so, the need for authenticated contributor access makes exploitation less likely in the wild, yet the potential for widespread impact on site visitors warrants prompt action. Attackers would typically create or modify content—such as an image title or caption—containing malicious script fragments that are later rendered when any user accesses that content. The reliance on a specific user role makes targeting relatively straightforward for sites with large contributor bases.