The Meta‑box GalleryMeta plugin for WordPress contains a stored cross‑site scripting flaw that is triggered by the image caption field in its administrative interface. An attacker who is authenticated with editor‑level rights or higher can submit a malicious script; that script will be stored and subsequently executed whenever a visitor loads a page that displays the manipulated caption. The CVE description does not provide any evidence of additional impact such as session hijacking, defacement or phishing; those outcomes are therefore not confirmed but remain possible if the script is capable of performing such actions.

All releases of the Meta‑box GalleryMeta plugin up to and including version 3.0.1 are affected. The vulnerability is limited to multi‑site WordPress installations and only when the unfiltered_html capability has been disabled. Users who own the plugin under these conditions and hold editor or higher roles are thus at risk.

The moderate CVSS score of 4.4 indicates that the integrity and confidentiality of site content can be compromised, but the risk of loss of availability is low. An EPSS score of less than 1 % suggests that, as of the time of analysis, the likelihood of exploitation is very low. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated session with at least editor privileges and the ability to edit the gallery caption via the plugin’s admin settings; once the malicious payload is stored, it executes for any user who views the affected gallery page.