This vulnerability (CVE-2025-31586) in the GhozyLab Gallery – Photo Albums Plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects versions up to 1.3.170. Exploitation requires low privileges and user interaction, and it can lead to partial compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. No patch or official vendor advisory is currently available, and no known active exploitation has been reported.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure, modification of data, or disruption of service. The impact is limited by the requirement for user interaction and low privileges, but the vulnerability affects confidentiality, integrity, and availability to some extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting privileges of users who can submit content, applying web application firewall (WAF) rules to detect and block XSS payloads, and educating users about the risks of interacting with untrusted content. Monitor vendor channels for updates and apply patches promptly once released.