The Easy Social Photos Gallery plugin for WordPress has a stored XSS flaw in versions 3.1.2 and older. The plugin uses sanitize_text_field() for the wrapper_class shortcode attribute instead of esc_attr(), allowing a contributor‑level user to insert an unescaped double quote and inject arbitrary HTML event handlers. When a user visits a page that has the injected attribute, the malicious script runs in that user’s browser, revealing confidentiality or allowing further attacks.

WordPress sites running Easy Social Photos Gallery plugin version 3.1.2 or earlier are affected. The vulnerability is triggered by the my‑instagram‑feed shortcode’s wrapper_class attribute, which is rendered in pages, posts, or widgets.

The CVSS score of 6.4 indicates a moderate severity. No EPSS score is available and the issue is not listed in CISA KEV, suggesting current exploitation is not widespread. However, because the attacker must be authenticated with at least contributor privileges, the attack vector is restricted to local contributors who can edit the shortcode attributes. Once an attacker injects a payload, every visitor to the affected page will execute the script, enabling data theft or defacement.