The vulnerability allows an authenticated user with Author or higher privileges to inject arbitrary JavaScript into the "justified_gallery_theme" parameter of the plugin. Because the input is not sanitized and output is not escaped, the script is stored and executed whenever a page containing the gallery is viewed. This can lead to theft of cookies, session hijacking, defacement, or broader compromise of other visitors’ browsers. The weakness is a classic stored cross‑site scripting flaw (CWE‑79).

The affected software is the Envira Gallery plugin for WordPress, produced by smub. All releases up to and including version 1.12.3 are vulnerable. WordPress sites running any of these plugin versions are at risk.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be an authenticated Author or higher on the affected WordPress site; they must submit a gallery configuration that includes a malicious "justified_gallery_theme" value, which is then stored in the database and rendered in subsequent page loads. The attack vector is local to the web application but can have remote effects on unauthenticated visitors who view the injected content.