The vulnerability CVE-2025-57974 in tuyennv's TZ PlusGallery plugin is a stored cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. This allows attackers with high privileges to inject malicious scripts that are stored and later executed in the context of other users viewing the affected pages. The issue affects all versions up to 1.5.5. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with limited impact on confidentiality, integrity, and availability. No patch or remediation information is currently available.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to limited confidentiality, integrity, and availability impacts. Since it is a stored XSS, the malicious payload persists on the affected site. However, exploitation requires user interaction and elevated privileges, which limits the attack surface. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to trusted personnel only and consider applying web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Monitor vendor channels for updates regarding patches or official mitigations.