The Paged Gallery plugin for WordPress is affected by a stored Cross‑Site Scripting flaw that can be triggered through the plugin’s gallery shortcode. The flaw originates from insufficient input sanitization and output escaping on user‑supplied attributes, enabling attackers to embed malicious scripts. Consequently, whenever a page containing the injected shortcode is viewed, the injected scripts execute in the browsers of all users who access the page.

The vulnerability is present in all releases of the Paged Gallery plugin up to and including version 0.7. Users who have installed any of these versions on a WordPress site are affected. No other products or versions are listed as impacted.

The CVSS base score of 6.4 reflects a moderate severity XSS risk. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not catalogued in CISA’s KEV. Attackers must first authenticate to the WordPress site with a Contributor role or higher, then supply the malicious attributes via the shortcode. Because the flaw is stored, the attack requires only a single authenticated visit to embed the payload; subsequent unauthenticated visitors to the affected page will experience the injected scripts.