The vulnerability allows an attacker to inject malicious scripts that are stored and later rendered in web pages. This can lead to session hijacking, credential theft, defacement, or spreading malware to anyone viewing the gallery. The issue stems from improper neutralization of user input during page generation.

WordPress sites that use the Books Gallery plugin by Hossni Mubarak, any release through 4.8.4 remains vulnerable. This includes currently installed versions of 4.8.4 and all earlier releases of the plugin. Sites running later than 4.8.5 are not affected.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is unavailable, so the current likelihood of exploitation is uncertain, though the vulnerability is publicly known and not listed in KEV. The exploit is likely to occur by an attacker submitting malicious content via the plugin’s input fields that is subsequently stored and served to visitors. A web application firewall or content security policy can reduce the risk until a patch is applied.