The plugin allows stored XSS through its login_link shortcode. An authenticated user with Contributor or higher privileges can supply a value for the prefix attribute that is stored and later rendered without proper sanitization. The injected payload executes in the browser context whenever a page containing the shortcode is viewed, providing a vector for session hijacking, defacement, or theft of credentials. The weakness is a classic reflected/embedded XSS flaw, catalogued as CWE‑79.

The Gallagher Website Design WordPress plugin, all releases up to and including version 2.6.4. Systems employing this plugin on a WordPress installation are potentially vulnerable if users can create or edit content using the login_link shortcode.

The CVSS score of 6.4 indicates a moderate severity vulnerability. Because the bug requires authenticated access at the Contributor level or higher, attackers must first gain or already possess such permissions. No EPSS information is available, and the issue is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Nonetheless, the stored nature of the flaw means any authenticated user can place harmful scripts that will run for all other site visitors. The absence of an official fix in the provided data means administrators should treat this as a high‑priority mitigation.