The vulnerability CVE-2025-23441 affects the Attach Gallery Posts plugin by dkukral, specifically versions up to 1.6. It is a reflected cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. An attacker can exploit this to inject malicious scripts that execute in users' browsers when they visit crafted URLs or pages. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated low to low to low respectively. No official patch or fix is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The reflected nature of the XSS requires user interaction (clicking a crafted link). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted links involving the Attach Gallery Posts plugin. Implementing web application firewalls (WAFs) that detect and block reflected XSS attempts may provide temporary mitigation.