The vulnerability is an Improper Neutralization of Input during web page generation that allows an attacker to store malicious script content within a gallery entry. When an unsuspecting user views the gallery, the script executes in the victim’s browser, potentially hijacking sessions, stealing cookies, or defacing the site. The flaw directly impacts confidentiality and integrity by enabling arbitrary client‑side code execution, and can indirectly affect availability if the malicious payload disrupts page rendering. The weakness is a classic stored XSS (CWE‑79).

Affected is the bPlugins Image Gallery block – Create and display photo gallery/photo album. plugin for WordPress. All installations of the plugin from its initial release up to and including version 2.4.1 are vulnerable, with the issue fixed in version 2.4.2 and later.

The CVSS score of 6.5 indicates medium severity. Exploitation requires the attacker to have author or administrative ability to create or edit a gallery entry; no network boundary is bypassed beyond the normal web application interaction. Because the exploit is a stored XSS, the attack can be performed by any user who can create or edit gallery content. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that, while valid, it may not be widely exploited yet. Nonetheless the risk profile warrants prompt remediation.