This vulnerability is a stored cross‑site scripting flaw in the Drupal PhotoSwipe gallery. Improper sanitization of user‑supplied input during page rendering allows an attacker to inject malicious JavaScript that is stored in the gallery and executed whenever a victim views the gallery. Stored XSS can result in credential theft, defacement, or the hijacking of authenticated sessions, compromising confidentiality and integrity of users and the site.

The flaw affects Drupal's PhotoSwipe gallery module versions 0.0.0 through 5.0.9. Any Drupal installation that includes this module and allows administrators or content creators to upload or edit gallery images without proper sanitization is vulnerable. The affected product is specifically the PhotoSwipe – Responsive JavaScript Modal Image Gallery for Drupal, and any site that uses any of the listed versions is at risk.

The CVSS score is 4.6, the EPSS score is < 1%, and the vulnerability is not in CISA’s KEV catalog. The likely attack vector is a stored cross‑site scripting flaw that could be introduced by uploading or editing gallery content via Drupal’s administrative interface. Based on the description, it is inferred that an attacker without elevated privileges can inject malicious code that is stored and later rendered to all users who view the gallery, potentially leading to credential theft or session hijacking. This makes the vulnerability broadly exploitable.