The Easy Image Gallery WordPress plugin contains a stored cross‑site scripting flaw in the gallery shortcode post metadata field because user‑supplied shortcode values are not properly sanitized or escaped. Attacks are limited to authenticated users with Contributor role or higher, who can insert arbitrary JavaScript into the shortcodes. When a page containing the infected shortcode is viewed, the malicious script runs in the visitor’s browser, enabling data theft, defacement, or session hijacking.

WordPress sites that have the Easy Image Gallery plugin delivered by devrix, version 1.5.3 or any earlier release, are affected by this vulnerability.

The flaw carries a CVSS score of 6.4, indicating moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated Contributor or higher, making the attack vector more limited but still feasible if privileged accounts are present. Attackers can deliver the payload via gallery shortcode insertion, and compromise occurs when victims load a page rendering the malicious shortcode, allowing the attacker to execute scripts in the victim’s browser context.