The WordPress Video Gallery Block plugin contains a stored cross‑site scripting flaw that allows an attacker to inject arbitrary JavaScript into gallery content that is rendered on visitor pages. The vulnerability, classified as CWE‑79, permits malicious code to execute in the browsers of anyone who views the gallery, potentially enabling credential theft, session hijacking, or defacement. The flaw results from the plugin’s failure to neutralize user‑supplied input before saving or rendering it.

The affected product is the bPlugins Video Gallery Block plugin for WordPress. All versions up through and including 1.6.0 contain the flaw; the fix is included in version 1.7.0 and later. Site administrators should confirm their installed plugin version and update if it is 1.6.0 or earlier.

The CVSS score of 6.5 indicates moderate severity; the EPSS score is unavailable, so the precise exploitation probability cannot be determined, and the vulnerability is not listed in CISA KEV. The likely attack vector involves an authenticated editor submitting gallery data through the WordPress admin interface; because the flaw is stored, no runtime prerequisites exist beyond write access to gallery content, making the exploitation effort relatively low. Once the injected code is stored, it runs in the browsers of users who view the gallery, allowing the attacker to execute arbitrary client‑side actions.