CVE-2025-32649

Deeper analysis

CVE-2025-32649 is a reflected cross-site scripting vulnerability (CWE-79) in the GB Gallery Slideshow WordPress plugin developed by gb-plugins. The flaw stems from improper neutralization of input during web page generation and affects all versions through 1.3. It carries a CVSS 3.1 score of 7.1 with a network attack vector, low complexity, no required privileges, and required user interaction, resulting in changed scope with low impacts to confidentiality, integrity, and availability.

An unauthenticated attacker can exploit the issue by crafting a malicious URL containing injected script that is reflected back to a victim who clicks the link. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to actions such as session hijacking, redirection, or limited manipulation of page content within the affected WordPress site.

The sole reference points to a Patchstack advisory entry for this plugin vulnerability, though no explicit patch version, workaround, or mitigation guidance is detailed in the provided data. The associated EPSS scores remain low, with a current value of 0.0067 and a peak of 0.0111, indicating limited observed exploitation interest to date.