This vulnerability allows an authenticated user with Author or higher role to embed malicious JavaScript into the gallery description field. During rendering of pages that display the gallery, the embedded script executes in the browsers of all visitors who view the page, potentially allowing credential theft, session hijacking, or defacement. The weakness is a classic stored XSS flaw caused by insufficient input sanitization and output escaping.

All installations of the Envira Gallery WordPress plugin with version numbers up to and including 1.12.4 are affected. The plugin is identified as smub:Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More.

The CVSS base score is 6.4, indicating a medium severity. No EPSS score is available at this time, so the exact probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers need only an Author+ account to create the malicious payload; no additional external access or privilege escalation is required. The stored nature of the flaw means the payload persists until removed by an administrator or the plugin is upgraded.