An improper neutralization of input in GalleryCreator SimpLy Gallery’s simply‑gallery‑block plugin allows stored cross‑site scripting (XSS). Malicious scripts inserted via gallery blocks are rendered on behalf of any visitor, enabling client‑side attacks such as theft of session cookies, defacement, or credential harvesting. The flaw is a typical input validation issue identified as CWE‑79.

The vulnerability affects the GalleryCreator SimpLy Gallery plugin, simply‑gallery‑block, for all releases up to and including version 3.2.5. Users running any of these versions with the plugin enabled are susceptible to exploitation.

The CVSS score of 6.5 indicates a moderate severity exploit. The EPSS score of less than 1% signals a low probability of exploitation in the wild, and the issue is not listed in CISA KEV. Attackers can inject malicious payloads by adding content to gallery blocks, which is then stored and served to all visitors. The vulnerability requires the attacker to discover or abuse the gallery block creation interface, but no privileged access or complex setup is needed.