A DOM‑based cross‑site scripting flaw allows an attacker to inject unsanitized input into Gallery PhotoBlocks pages, enabling the execution of arbitrary JavaScript within a visitor’s browser. The vulnerability arises from improper neutralization of user supplied data during page generation, as defined by the CWE‑79 classification.

The issue affects the WP Chill:Gallery PhotoBlocks plugin for WordPress in all releases from the initial version up to and including version 1.3.2. WordPress sites that install any of these versions are potentially vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is less than 1 %, implying a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is DOM‑based, an attacker must supply crafted input that a user later interacts with (e.g., via a link or form), making user interaction a prerequisite for exploitation.