The vulnerability is a stored cross‑site scripting flaw caused by inadequate input sanitization when rendering gallery content. An attacker who can insert arbitrary data into the plugin’s storage can later trigger execution of malicious scripts in the browsers of visitors to pages that display the affected gallery. This can lead to theft of session cookies, defacement, or redirection to phishing sites, thereby compromising confidentiality and integrity of user data. The flaw is a classic injection weakness (CWE‑79).

WordPress plugin "Awesome Wp Image Gallery" from nayon46, versions up to and including 1.0 are affected. All installations using these versions are susceptible, regardless of the WordPress core or theme in use.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests that active exploitation is unlikely at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be via the plugin’s input controls, which require authenticated access to insert gallery items. Once the data is stored, any user who browses the gallery page can be victim to the XSS payload. Given these conditions, the risk is moderate but active exploitation is improbable at the time of this assessment.