Improper neutralization of input during web page generation allows a stored cross‑site scripting vulnerability in the YouTube Simple Gallery WordPress plugin. An attacker can inject malicious JavaScript that is persisted in the gallery data and later executed whenever a user loads a gallery page. The injected code can steal session information, deface the site, or perform other client‑side attacks as described by CWE‑79.

The vulnerability affects the WordPress YouTube Simple Gallery plugin published by CHR Designer, specifically all versions up to and including 2.2.0. No other products or version ranges were identified as impacted.

The CVSS base score of 6.5 indicates a moderate severity. The EPSS score of <1% suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The likely exploitation scenario is inferred from the description: an attacker who can add or edit gallery content—typically an authenticated user with editor or administrator privileges—may insert arbitrary script payloads into the stored gallery information, which are then executed in visitors’ browsers.