The plugin contains a stored cross‑site scripting flaw that occurs when URLs are entered in any widget and the input is not fully sanitized or escaped. This flaw enables an attacker who can authenticate to the site with Contributor level or higher to inject arbitrary JavaScript that will execute in the browsers of any visitor who loads the affected page. The injected code can steal user credentials, deface the site, or perform further malicious actions on behalf of the victim; the weakness is identified as CWE‑79.

The flaw affects all versions of BDThemes Pixel Gallery Addons for Elementor, including Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout and Portfolio Gallery, for all widget URLs in versions up to and including 1.6.7. Only systems running those versions of the plugin are impacted.

The CVSS score of 6.4 denotes moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires a valid Contributor‑level account and the ability to edit widget URLs; the attack vector is therefore authenticated, but once the malicious script is stored it will affect all site visitors. Given the stored nature of the flaw, the malicious payload will persist until the plugin is updated or the stored data is sanitized.