Improper neutralization of user input during page rendering in the WordPress Gallery PhotoBlocks plugin creates a stored XSS vulnerability. An attacker who can add gallery content can insert a malicious script that will execute in the browsers of any site visitor who views the gallery, potentially allowing the attacker to manipulate the page or steal session data within the victim’s context.

The vulnerability affects the WP Chill Gallery PhotoBlocks plugin in all releases from the initial unknown version up to and including 1.3.7. Any WordPress site that has installed one of those versions is susceptible to the stored XSS flaw.

The CVSS score of 6.5 indicates moderate severity. An EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to have the ability to insert content into the gallery, which normally necessitates a role with content‑creation privileges such as an administrator or contributor. Once the malicious payload is stored, it will execute automatically for any visitor who views the gallery, making the exploitation straightforward for those with permission to publish gallery items.