An unauthenticated Cross Site Scripting flaw exists in WordPress Global Gallery plugin versions 11.1.2 and earlier, enabling an attacker to inject malicious scripts that will run in the browsers of visitors who load impacted pages. This flaw is classified as CWE‑79 and directly compromises the user experience by allowing unintended script execution.

The vulnerability affects the LCweb Global Gallery plugin for WordPress, specifically all releases up to and including 11.1.2. Site administrators should verify the plugin version and any related ancillary components for patch status.

The CVSS score of 7.1 signifies a moderate to high risk. EPSS score of < 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because no authentication is required, any visitor can be the vector for exploitation, making the risk actionable through patching rather than mitigation. The attacker’s primary requirement is to supply crafted input via the plugin’s front‑end interface or URLs, after which the malicious code executes in the context of the site’s visitor.