The vulnerability results from improper neutralization of user input during web page generation, allowing stored XSS in the JNews Gallery plugin. An attacker who injects malicious script into gallery content can force that script to run in the browsers of visitors to the affected page, potentially leading to defacement, phishing, or session hijacking. The weakness is classified as CWE‑79.

WordPress sites that run jegtheme JNews Gallery version earlier than 12.0.1 are affected. This includes all builds from the first release up to, but not including, 12.0.1. Any site using these versions is vulnerable until the update is applied.

With a CVSS score of 6.5 the severity is medium. The EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to insert a payload into gallery content, which most likely means having permission to add or edit gallery items in WordPress. This assumption about the required privileges is inferred from the plugin’s content management interface, as the CVE description does not explicitly state the necessary attack vector. Once the payload is stored, it is served to all visitors of pages that display the gallery, meaning the attack can affect multiple users on a single site.