The SimpLy Gallery Block & Lightbox plugin for WordPress contains a stored cross‑site scripting flaw that targets the sliderMaxHeight block attribute. The plugin’s sanitization routine removes only quoted event handlers, unintentionally allowing unquoted handlers to persist. When an attacker can edit a page with Author‑level or higher permissions, they can embed arbitrary JavaScript in that attribute. The script runs in visitors’ browsers whenever the block is rendered, potentially stealing session cookies, injecting malicious content, or defacing the site. The impact is direct code execution in the victim’s browser context, leading to credential theft or defacement.

Any WordPress installation that has the SimpLy Gallery plugin installed on a version up to and including 3.3.3.2 is vulnerable. Versions newer than 3.3.3.2 are not known to contain the flaw and are presumed safe.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity, and an EPSS score below 1 %, implying a low exploitation probability. The flaw is not listed in CISA’s KEV catalog. Attackers must first be authenticated with Author or higher privileges to modify the sliderMaxHeight attribute; once the payload is stored, it automatically executes for every visitor who loads the affected page, exposing the site to cross‑site scripting but only for users with such privileges to inject the payload.