The Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the plugin fails to adequately sanitize and escape user-supplied caption attributes in its lightbox feature, allowing authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code. This code executes in the context of any user who views the compromised page, potentially leading to session hijacking, defacement, or other script-based attacks. The vulnerability affects all versions up to 3.21. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction needed, and partial impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages displayed by the plugin. This can lead to unauthorized actions performed in the context of other users viewing the affected pages, including potential data theft or manipulation. The impact is limited to confidentiality and integrity with no direct availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Photonic Gallery & Lightbox plugin if possible. Monitor for updates from the vendor and apply official patches promptly once released.