The CVE describes an improper neutralization of input during web page generation in the GalleryCreator SimpLy Gallery plugin. The flaw allows malicious script code to be stored in gallery content, which is later rendered on gallery pages without proper escaping. This stored XSS vulnerability directly maps to CWE‑79 and could permit the execution of arbitrary JavaScript in the browsers of visitors to the affected gallery pages.

WordPress installations that include the GalleryCreator SimpLy Gallery plugin version 3.3.2.1 or earlier and utilize the simply‑gallery‑block component are affected. Any site that has not upgraded past this release is at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the gallery creation or editing interface, where an attacker who can add or modify gallery content may insert malicious payloads. Once stored, the payload executes in the browsers of all visitors who view the gallery page, potentially compromising the confidentiality and integrity of affected users.