The Tiled Gallery Carousel Without JetPack plugin contains a stored cross‑site scripting flaw that occurs when the data‑image-title attribute is not sanitized. An authenticated user with contributor privilege can supply a malicious value that will be stored and later rendered without escaping, allowing client‑side code execution on any visitor that opens the gallery.

All installations of Raja3c’s Tiled Gallery Carousel Without JetPack plugin version 3.1 or earlier are vulnerable. The flaw is independent of the underlying WordPress core version and will affect any WordPress site that hosts the vulnerable plugin.

The CVSS score of 5.4 indicates medium severity. EPSS is not available, and the flaw is not listed in CISA KEV. Attack requires authenticated contributor or higher access; the malicious payload is stored in the plugin’s database and rendered unescaped when a gallery page is displayed. Any user who visits the infected page will execute the injected script, creating a client‑side code execution channel that could be used for session hijacking, defacement, or phishing.