Technical impact
This vulnerability allows an attacker to store malicious script code in the Gallery PhotoBlocks plugin, which is then rendered in the browser of any visitor to pages displaying the gallery. The stored XSS can lead to credential theft, defacement, or the execution of arbitrary client‑side code, compromising the confidentiality and integrity of users’ sessions and potentially enabling phishing or malware delivery.
Affected Systems
The weakness exists in the WP Chill Gallery PhotoBlocks plugin in all releases up through version 1.3.7. Any WordPress site that has installed this plugin version, regardless of the underlying WordPress or server environment, is susceptible until an upgrade to version 1.3.8 or later is performed.
Risk and Exploitability
The CVSS score of 6.5 indicates a medium severity risk. The EPSS score is not available, but the lack of a CISA KEV listing suggests no widely known active exploitation yet. Attacks would target browsers that load gallery pages, with the attacker typically requiring only the ability to create or modify gallery content—information that may be available to authenticated users with content permissions. This makes the vulnerability exploitable in environments where gallery creation and editing are allowed to unauthenticated or poorly managed users.
