CVE-2025-32176

WordPress Gallery Blocks with Lightbox plugin <= 3.2.5 - Stored Cross Site Scripting (XSS) vulnerability

Published Apr 4, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Stored XSS.This issue affects SimpLy Gallery: from n/a through <= 3.2.5.

Analysis

Technical impact

An improper neutralization of input in GalleryCreator SimpLy Gallery’s simply‑gallery‑block plugin allows stored cross‑site scripting (XSS). Malicious scripts inserted via gallery blocks are rendered on behalf of any visitor, enabling client‑side attacks such as theft of session cookies, defacement, or credential harvesting. The flaw is a typical input validation issue identified as CWE‑79.

Affected Systems

The vulnerability affects the GalleryCreator SimpLy Gallery plugin, simply‑gallery‑block, for all releases up to and including version 3.2.5. Users running any of these versions with the plugin enabled are susceptible to exploitation.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity exploit. The EPSS score of less than 1% signals a low probability of exploitation in the wild, and the issue is not listed in CISA KEV. Attackers can inject malicious payloads by adding content to gallery blocks, which is then stored and served to all visitors. The vulnerability requires the attacker to discover or abuse the gallery block creation interface, but no privileged access or complex setup is needed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

GalleryCreator

SimpLy Gallery

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.2.5

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the latest version of SimpLy Gallery (≥ 3.2.6) to eliminate the stored XSS flaw.
If an upgrade is not possible immediately, remove or disable the gallery block functionality until the plugin is patched, preventing the injection of malicious content.
Audit all existing gallery blocks for hidden scripts, remove any injected code, and clear the site’s cache to ensure users no longer receive compromised content.

Generated by OpenCVE AI on May 1, 2026 at 00:34 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-9850	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator Gallery Blocks with Lightbox allows Stored XSS.This issue affects Gallery Blocks with Lightbox: from n/a through 3.2.5.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.407% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/simply-gallery-block/vulnerability/wordpress-gallery-blocks-with-lightbox-plugin-3-2-5-stored-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator Gallery Blocks with Lightbox allows Stored XSS.This issue affects Gallery Blocks with Lightbox: from n/a through 3.2.5.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Stored XSS.This issue affects SimpLy Gallery: from n/a through <= 3.2.5.
References	https://patchstack.com/database/wordpress/plugin/simply-gallery-block/vulnerability/wordpress-gallery-blocks-with-lightbox-plugin-3-2-5-stored-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/simply-gallery-block/vulnerability/wordpress-gallery-blocks-with-lightbox-plugin-3-2-5-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`

Apr 22, 2025 9:00 AM Description updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator Gallery Blocks with Lightbox allows Stored XSS. This issue affects Gallery Blocks with Lightbox: from n/a through 3.2.5.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator Gallery Blocks with Lightbox allows Stored XSS.This issue affects Gallery Blocks with Lightbox: from n/a through 3.2.5.

Apr 4, 2025 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 4, 2025 4:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GalleryCreator Gallery Blocks with Lightbox allows Stored XSS. This issue affects Gallery Blocks with Lightbox: from n/a through 3.2.5.
Title		WordPress Gallery Blocks with Lightbox plugin <= 3.2.5 - Stored Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/simply-gallery-block/vulnerability/wordpress-gallery-blocks-with-lightbox-plugin-3-2-5-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}`