The Gallerycreator Mixed Media Gallery Blocks plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'galleryID' and 'className' parameters are not properly sanitized or escaped, allowing authenticated users with Contributor-level permissions or higher to inject arbitrary scripts. These scripts execute in the context of any user who accesses the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 3.2.1. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, scope change, and limited confidentiality and integrity impacts without availability impact. No patch or vendor advisory is currently available, and no known exploits have been reported.

An authenticated attacker with Contributor-level access or higher can inject malicious scripts via vulnerable parameters, which execute when other users view the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed in the context of other users. There is no impact on availability. The vulnerability affects all users who access the injected content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the vulnerable plugin to prevent exploitation.