The Gallery PhotoBlocks WordPress plugin, in versions prior to 1.3.6, fails to sanitize a gallery setting inserted into an HTML attribute. This omission allows contributors or higher‑privileged users to store JavaScript that runs whenever any user, including privileged administrators, loads a page containing the gallery. Because the vulnerability is stored, it can persist across sessions and attackers can silently compromise multiple users. The weakness represents a classic stored cross‑site scripting flaw, exposing confidentiality, integrity, and availability of the web application for all users who view the affected gallery pages.

The impact is limited to installations of the Gallery PhotoBlocks WordPress plugin version 1.3.5 and earlier. The vulnerability applies to any WordPress site that has this plugin installed and allows contributors or above to modify gallery settings. No other vendors or products are mentioned as affected.

The vulnerability has a CVSS score of 6.8, no publicly available EPSS score, and is not listed in the CISA KEV catalog. The attack requires a user with Contributor role or higher to inject the payload, which is then served to all page viewers. Locally the attacker can create malicious gallery content, which subsequent normal users will experience as browser script execution. Because the attack vector is within the web application and does not rely on external network resources, it can be exploited remotely via the plugin’s settings interface. Given the access level required, attackers typically must already have legitimate site access or social‑engineering credentials to reach the Contributor role. The potential impact remains widespread due to the stored nature of the injection.