The Product Video Gallery for WooCommerce plugin, available through the nikhilgadhiya repository, contains a stored cross‑site scripting vulnerability that is triggered via the custom_thumbnail parameter. Insufficient input sanitization and output escaping allow an authenticated user with shop manager or higher privileges to embed arbitrary JavaScript into the custom_thumbnail field, which is later rendered to all site visitors. The CVE description does not explicitly state that session hijacking, defacement, or other client‑side exploits can occur; these outcomes are inferred based on the nature of the stored XSS vector.

Any WordPress installation that has the Product Video Gallery for WooCommerce plugin by nikhilgadhiya installed and running a version up to and including 1.5.1.8 is affected. Newer releases beyond 1.5.1.8 are considered safe; earlier or older releases are also impacted as per the CVE data.

The vulnerability carries a CVSS score of 4.4, indicating moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, reaffirming its lower public exploitation profile. Exploitation requires authenticated access at the shop manager level or higher, and the typical attack path involves the plugin’s administrative interface where the custom_thumbnail value is stored and later rendered to normal users. Although the impact is limited to sites where the custom_thumbnail feature is enabled, successful exploitation would allow an attacker to run malicious scripts in the browsers of site visitors, potentially leading to credential theft or defacement of content.