The JNews Gallery plugin by jegtheme contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with low privileges to inject malicious scripts that are stored and later executed in the context of other users' browsers, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability affects all versions before 12.0.1. No patch or official remediation information is currently provided, and no known exploits have been observed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to limited data disclosure, modification, or disruption of service. The impact is rated medium with a CVSS score of 6.5, reflecting the need for user interaction and low privilege requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input that can be rendered in the gallery and applying web application firewall rules to detect and block XSS payloads related to this plugin.