Improper neutralization of user input in the Gallery Custom Links plugin allows an attacker to store malicious scripts that are rendered when the gallery is viewed, leading to a stored cross‑site scripting (XSS) vulnerability. The injected code can steal session cookies, deface pages, or perform other malicious actions on behalf of the visitor. This flaw maps to CWE‑79 and poses a threat to the confidentiality and integrity of users visiting the affected site.

All installations of Jordy Meow: Gallery Custom Links up to and including version 2.2.5 are affected. Any WordPress site that uses this plugin within that version range is vulnerable if the plugin is enabled.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is below 1%, suggesting limited evidence of exploitation so far. The vulnerability is not listed in CISA KEV. Attackers would need to add or edit a link through the plugin’s interface to inject malicious data; legitimate users who view the gallery would then be exposed. Because the flaw is stored, it can affect many visitors from a single injection.