The bPlugins Video Gallery Block plugin versions up to 1.1.0 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This vulnerability (CVE-2025-27326) allows an attacker with low privileges and requiring user interaction to inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in stored XSS attacks, which may allow attackers to execute arbitrary scripts in the browsers of users who view the affected content. This can lead to limited disclosure of information, modification of data, or disruption of service. The impact is limited by the requirement for user interaction and low privileges needed by the attacker. There are no reports of active exploitation in the wild.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider limiting exposure by restricting user input capabilities or applying web application firewall rules to detect and block XSS payloads related to this plugin.