The Vantage WordPress theme contains an insufficient output‑escaping flaw in the gallery block’s text content. An attacker who can authenticate as a contributor or higher can inject arbitrary JavaScript that is stored and then executed on any page that includes the malicious gallery content. The impact is a classic stored XSS that can compromise user sessions, modify content, or perform drive‑by attacks while the visitor’s browser processes the embedded scripts. The weakness is classified as CWE‑79.

Vantage theme for WordPress by SiteOrigin, versions 1.20.32 and earlier. Any site using these releases and allowing contributors to edit gallery blocks is affected.

The CVSS score of 6.4 indicates a moderate severity. No EPSS score is currently available, so exploit probability is unknown. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. An attacker would need authenticated access with contributor role or higher, but once in, can target any visitor who loads the injected content. The flaw exploits a web application layer weakness rather than a network‑level or privilege‑escalation issue.