Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery awesome-gallery allows Stored XSS.This issue affects Awesome Gallery: from n/a through <= 1.0.
Published: 2025-05-07
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The CVE describes an improper neutralization of input that results in stored XSS. This flaw permits an attacker to inject malicious scripts into web pages rendered by WordPress, leading to potential session hijacking, data theft, or phishing. The weakness (CWE‑79) means the input is saved and served without sanitization.

Affected Systems

The vulnerability exists in WordPress Awesome Gallery plugin by Raihanul Islam, affecting all versions from the earliest through 1.0. Any installation using the plugin with a version number 1.0 or lower is exposed.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. EPSS < 1% suggests low exploitation probability, and the vulnerability is not listed in KEV. The attack vector is inferred: an attacker would need a path to submit malicious content—typically via gallery upload functionality—which, if unsanitized, is stored and then served to all users. Once an image or gallery item is stored, every user who views the gallery triggers the injected script.

Generated by OpenCVE AI on May 1, 2026 at 08:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Awesome Gallery plugin to the most recent stable release once it incorporates the XSS fix; if no fix version exists, remove the plugin entirely.
  • If an update is unavailable, limit gallery content submissions to authorized users only or disable public uploads to eliminate the entry point for malicious input.
  • Apply a Content Security Policy or deploy a Web Application Firewall configured to block or sanitize script payloads, thereby mitigating the impact of stored XSS.

Generated by OpenCVE AI on May 1, 2026 at 08:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-13753 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery allows Stored XSS. This issue affects Awesome Gallery: from n/a through 1.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery allows Stored XSS. This issue affects Awesome Gallery: from n/a through 1.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery awesome-gallery allows Stored XSS.This issue affects Awesome Gallery: from n/a through <= 1.0.
Title WordPress Awesome Gallery <= 1.0 - Cross Site Scripting (XSS) Vulnerability WordPress Awesome Gallery plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00034}

 epss

{'score': 0.00039}

Mon, 12 May 2025 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Raihancse
Raihancse awesome Gallery
CPEs cpe:2.3:a:raihancse:awesome_gallery:1.0:*:*:*:*:wordpress:*:*
Vendors & Products Raihancse
Raihancse awesome Gallery

Thu, 08 May 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 07 May 2025 14:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery allows Stored XSS. This issue affects Awesome Gallery: from n/a through 1.0.
Title WordPress Awesome Gallery <= 1.0 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Raihancse Awesome Gallery
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:47.411Z

Reserved: 2025-05-07T10:44:48.425Z

Link: CVE-2025-47632

cve-icon Vulnrichment

Updated: 2025-05-08T15:15:33.939Z

cve-icon NVD

Status : Modified

Published: 2025-05-07T15:16:16.370

Modified: 2026-04-23T15:30:38.753

Link: CVE-2025-47632

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T08:45:06Z

Weaknesses