Cross‑Site Request Forgery in the WordPress Add Linked Images To Gallery plugin lets an attacker cause a logged‑in user to send a request that stores arbitrary JavaScript in the gallery data. The stored script is rendered in galleries viewed by anyone, enabling session hijacking, data theft, defacement, or further exploitation of site privileges.

The vulnerability affects the WordPress Add Linked Images To Gallery plugin, shipped by tiefpunkt, in all releases up through version 1.4. Any WordPress site that has this plugin installed and active is potentially impacted.

The vulnerability carries a CVSS score of 7.1, indicating significant risk, but its EPSS score is below 1% and it is not listed in CISA’s KEV catalog, suggesting it is not widely exploited yet. The likely attack vector requires the victim to be a privileged user who is tricked into visiting a crafted link that submits the malicious request. Unlike typical CSRF, the attacker relies on the victim’s authenticated session to persist the malicious payload, which is subsequently executed for all users who view the infected gallery.