The vulnerability arises from the bundled lightGallery JavaScript library (version 2.8.3 or earlier) used by several WordPress plugins and themes. Insufficient sanitization of user‑supplied attributes allows an attacker who can authenticate as a Contributor or higher to store arbitrary JavaScript code in gallery or image metadata. When an affected page is viewed, the injected script runs in the context of the site, enabling content theft, session hijacking, or site defacement.

Any WordPress site that has one of the following plugins or themes installed and is using lightGallery 2.8.3 or older: OnePress, Gallery with thumbnail slider, LightGallery WP, Image Hover Effects Ultimate, TP WooCommerce Product Gallery, Ibtana – WordPress Website Builder, Royal Addons for Elementor – Addons and Templates Kit for Elementor, Portfolio, Gallery, Product Catalog – Grid KIT Portfolio. Precise version ranges are not listed; the issue exists in all releases that contain the vulnerable library.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with Contributor or higher privileges; once injected, the malicious script will affect all users who view the page containing the stored payload. Active defenses such as a Content Security Policy could mitigate the impact, but no automated exploit has been reported.