The vulnerability is a stored Cross‑Site Scripting flaw caused by the plugin’s failure to properly neutralize user input. Attackers can inject malicious scripts that are stored and later rendered within the web page, allowing them to run arbitrary code in the context of any visitor who loads the affected page. The weakness is categorized as CWE‑79, reflecting the lack of proper input validation and output encoding.

All installations of GhozyLab Gallery Lightbox that use version 1.0.0.41 or earlier are affected, including every earlier release. The issue is present in the plugin’s gallery‑lightbox‑slider component and can be triggered through any user interface that accepts content for display via the plugin.

The CVSS score of 6.5 classifies the flaw as medium‑severity; the EPSS score of less than 1% indicates a very low probability of exploitation at the moment. The vulnerability is not listed in the CISA KEV catalog. Because it is a stored XSS flaw, an attacker would need to inject malicious content through an interface that accepts input for the plugin—typically a logged‑in administrative user or a content creator with access to the gallery settings. Once injected, the attack can affect all visitors who load pages rendered by the gallery lightbox.