The Image Gallery plugin for WordPress contains a reflected cross‑site scripting flaw in all releases up to and including 1.0.0 because user input is not properly sanitized and output is not escaped. An unauthenticated attacker can embed malicious JavaScript that will run in the browser of any visitor that loads a gallery page. The injected script could steal session cookies, alter page content, or redirect users to phishing sites, thereby compromising confidentiality, integrity, and user experience.

The vulnerability affects the aumsrini Image Gallery WordPress plugin for any WordPress installation that has an installed version 1.0.0 or earlier. Any host running WordPress with this plugin, regardless of site ownership or user roles, is in scope.

The CVSS score of 6.1 indicates moderate severity, but the EPSS score is below 1 %, suggesting that exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog, which reduces concern about active exploitation campaigns. Attackers can invoke the flaw through a crafted URL or form input that is reflected by the plugin, making the attack vector public and straightforward for unauthenticated users. If exploited, it can lead to user‑side script execution, compromising the security of visitors rather than the server itself.