The vulnerability is an unauthenticated cross‑site scripting flaw that allows an attacker to inject malicious script into the Document Gallery plugin data fields. This flaw permits the attacker to execute arbitrary JavaScript in the browser of any user who views the affected gallery, which can lead to session hijacking, credential theft, or defacement. The weakness is a classic input validation flaw identified as CWE‑79.

Affected are installations of the Dan Rossiter Document Gallery WordPress plugin with a version of 5.1.1 or older. No other products or versions are listed in the CNA data. The flaw resides in the plugin’s data handling code that does not properly escape user supplied content.

The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability. The EPSS score of 0.00191 (< 1%) indicates a very low probability that this vulnerability will be exploited in the wild, yet the CVSS assessment shows it remains a serious risk. The flaw is not currently listed in CISA’s KEV catalog. Exploitation requires no authentication and could be carried out by inserting malicious JavaScript into a gallery entry or via a crafted URL parameter, meaning any visitor to the affected site is potentially at risk.