This vulnerability in Photo Gallery by Supsystic (<= 1.15.16) involves improper neutralization of input during web page generation, leading to a cross-site scripting (XSS) flaw. The CVSS 3.1 score is 5.9 (medium), with an attack vector of network, low attack complexity, requiring high privileges and user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been observed.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of the affected application, potentially leading to limited disclosure or modification of data and some disruption of service. However, exploitation requires user interaction and high privileges, limiting the scope and ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access and be cautious with user input handling in the affected plugin. Monitor for vendor updates regarding patches or mitigations.