The Video Gallery plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject arbitrary scripts via admin settings, which execute when other users access the affected pages. This vulnerability affects multi-site installations or installations with unfiltered_html disabled, across all versions up to 2.4.1. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction. There is no vendor advisory or patch information available at this time.

An authenticated attacker with administrator-level permissions can inject malicious scripts into the plugin's admin settings, leading to stored XSS that executes in the context of users visiting the affected pages. This can result in limited confidentiality and integrity impacts, such as session hijacking or content manipulation. The vulnerability does not impact availability. The attack requires high privileges and affects multi-site or restricted HTML capability WordPress environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or replacing the affected plugin in multi-site or unfiltered_html-disabled environments. Monitor official totalsoft channels for updates or patches addressing this vulnerability.