The Gallery Manager plugin for WordPress suffers from a reflected XSS vulnerability due to improper neutralization of input during web page generation. Specifically, the use of remove_Query_Arg without appropriate escaping on URLs enables attackers to inject malicious scripts. This vulnerability affects all versions up to 1.6.58 and can be exploited by unauthenticated attackers who can convince users to click on maliciously crafted links, resulting in script execution within the victim's browser context.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session when the victim clicks a crafted link. This can lead to information disclosure, session hijacking, or other actions permitted by the executed script. The vulnerability does not impact availability and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links and consider disabling or replacing the Gallery Manager plugin if possible. Monitor vendor channels for updates regarding patches or official mitigations.