The Gallery Custom Links plugin allows a Subscriber or higher level user to inject arbitrary JavaScript into pages by combining an unescaped display name with a comment body that preserves HTML. The attacker’s payload is stored and later injected into the rendered page, enabling arbitrary script execution in the context of users who view the affected content. This vulnerability is a classic Cross‑Site Scripting flaw (CWE‑79).

Any WordPress site running Gallery Custom Links version 2.3.3 or earlier is affected. The vulnerability is present in the tigroumeow:Gallery Custom Links installation, and the issue remains until the plugin is upgraded beyond 2.3.3.

The CVSS score of 4.9 signifies moderate risk. The EPSS score of less than 1 % indicates a very low likelihood of exploitation in current real‑world usage, and the issue is not listed in the CISA KEV catalog. The attack requires an authenticated account with at least subscriber privileges, creation of a comment containing the malicious HTML payload, and setting a matching noise key in the user’s display name, which survive WordPress’s default filtering before the plugin’s output‑buffering pass performs substitution. Because both inputs must be coordinated, the attack surface is limited, but once achieved it can compromise any visitor to the commented page.