CVE-2025-47632

WordPress Awesome Gallery plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

View on CVE.org
Published May 7, 2025 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery awesome-gallery allows Stored XSS.This issue affects Awesome Gallery: from n/a through <= 1.0.

Analysis

AI-generated

Technical impact

The CVE describes an improper neutralization of input that results in stored XSS. This flaw permits an attacker to inject malicious scripts into web pages rendered by WordPress, leading to potential session hijacking, data theft, or phishing. The weakness (CWE‑79) means the input is saved and served without sanitization.

Affected Systems

The vulnerability exists in WordPress Awesome Gallery plugin by Raihanul Islam, affecting all versions from the earliest through 1.0. Any installation using the plugin with a version number 1.0 or lower is exposed.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. EPSS < 1% suggests low exploitation probability, and the vulnerability is not listed in KEV. The attack vector is inferred: an attacker would need a path to submit malicious content—typically via gallery upload functionality—which, if unsanitized, is stored and then served to all users. Once an image or gallery item is stored, every user who views the gallery triggers the injected script.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Awesome Gallery plugin to the most recent stable release once it incorporates the XSS fix; if no fix version exists, remove the plugin entirely.
  • If an update is unavailable, limit gallery content submissions to authorized users only or disable public uploads to eliminate the entry point for malicious input.
  • Apply a Content Security Policy or deploy a Web Application Firewall configured to block or sanitize script payloads, thereby mitigating the impact of stored XSS.

Generated by OpenCVE AI on May 1, 2026 at 08:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-13753 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery allows Stored XSS. This issue affects Awesome Gallery: from n/a through 1.0.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery allows Stored XSS. This issue affects Awesome Gallery: from n/a through 1.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery awesome-gallery allows Stored XSS.This issue affects Awesome Gallery: from n/a through <= 1.0.
Title WordPress Awesome Gallery <= 1.0 - Cross Site Scripting (XSS) Vulnerability WordPress Awesome Gallery plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}
Type Values Removed Values Added
Metrics epss

{'score': 0.00034}

 epss

{'score': 0.00039}
Type Values Removed Values Added
First Time appeared Raihancse
Raihancse awesome Gallery
CPEs cpe:2.3:a:raihancse:awesome_gallery:1.0:*:*:*:*:wordpress:*:*
Vendors & Products Raihancse
Raihancse awesome Gallery
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raihanul Islam Awesome Gallery allows Stored XSS. This issue affects Awesome Gallery: from n/a through 1.0.
Title WordPress Awesome Gallery <= 1.0 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}
Earlier changes (1)
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:12 PM
Reserved
May 7, 2025, 10:44 AM

View source JSON

Updated
May 8, 2025, 3:15 PM

JSON

Status
Modified
Published
May 7, 2025, 3:16 PM
Modified
Jun 17, 2026, 9:28 AM

View source JSON

No data.

Updated
May 1, 2026, 8:45 AM

JSON