CVE-2025-47677: gt3-photo-video-gallery Stored XSS Flaw

CVE-2025-47677 Overview

CVE-2025-47677 is a stored Cross-Site Scripting (XSS) vulnerability in the gt3themes Photo Gallery WordPress plugin (gt3-photo-video-gallery). The flaw stems from improper neutralization of user-supplied input during web page generation [CWE-79]. All plugin versions up to and including 2.7.7.25 are affected. An authenticated attacker with contributor-level access can inject persistent JavaScript payloads that execute in the browsers of site visitors and administrators who view affected gallery content.

Critical Impact
Successful exploitation enables session hijacking, credential theft, and administrative account takeover through malicious script execution in the WordPress admin context.

Affected Products

gt3themes Photo Gallery (gt3-photo-video-gallery) WordPress plugin
All versions from initial release through 2.7.7.25
WordPress sites embedding the GT3 Image Gallery Gutenberg block

Discovery Timeline

2025-05-07 - CVE-2025-47677 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47677

Vulnerability Analysis

The vulnerability resides in the plugin's handling of user-controlled input within the GT3 Image Gallery Gutenberg block. Input passed to gallery attributes is stored in the WordPress database without adequate sanitization or output encoding. When the gallery renders on either the front-end or the block editor preview, injected HTML and JavaScript execute in the browser context of any user viewing the page.

Because the payload persists in post metadata, every visitor to an affected page triggers script execution without further attacker interaction. The scope change reflected in the CVSS vector indicates the impact extends beyond the vulnerable plugin to the broader WordPress session and origin.

Root Cause

The plugin fails to apply WordPress sanitization helpers such as wp_kses_post(), esc_attr(), or esc_html() when processing gallery block attributes submitted by contributors or higher-privileged users. Stored values are echoed directly into rendered markup, allowing arbitrary HTML attributes and <script> tags to survive persistence and output.

Attack Vector

An authenticated user with at least contributor privileges creates or edits a post containing the GT3 Image Gallery block. The attacker supplies a crafted payload in a gallery field, saves the post, and waits for an administrator or visitor to load the page. Exploitation requires user interaction to trigger rendering but does not require elevated administrative rights on the target site.

The vulnerability is described in prose only, as no verified public proof-of-concept code is available. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-47677

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handler attributes (onerror, onload, onclick) stored in wp_posts.post_content for posts containing the gt3-image-gallery block
Outbound requests from visitor browsers to unknown domains sourced from WordPress pages hosting gallery content
New administrator accounts or modified user roles created shortly after gallery pages are viewed by privileged users

Detection Strategies

Query the WordPress database for gallery block attributes containing HTML tags, encoded script markers, or suspicious protocols
Enable Content Security Policy (CSP) reporting to surface inline script violations originating from pages using the plugin
Review web server access logs for anomalous POST requests to /wp-json/wp/v2/posts or admin-ajax.php from contributor accounts

Monitoring Recommendations

Alert on installation of gt3-photo-video-gallery versions at or below 2.7.7.25 across managed WordPress fleets
Monitor for administrator session anomalies such as cookie theft indicators or unexpected privilege changes
Track file integrity of plugin directories and WordPress core to identify secondary payloads dropped after successful XSS exploitation

How to Mitigate CVE-2025-47677

Immediate Actions Required

Upgrade the gt3-photo-video-gallery plugin to a version released after 2.7.7.25 as soon as the vendor publishes a patched build
Audit all posts and pages containing GT3 gallery blocks and remove any content containing injected script or unexpected HTML attributes
Rotate WordPress administrator passwords and invalidate active sessions if suspicious gallery content is discovered

Patch Information

Refer to the Patchstack Vulnerability Report for the latest patched version and vendor guidance. Apply updates through the WordPress plugin manager or via WP-CLI in staging before production rollout.

Workarounds

Restrict contributor and author role assignments until the plugin is patched, limiting who can create or edit gallery content
Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or event handler attributes targeting gallery block endpoints
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering the vulnerable plugin
Temporarily deactivate the gt3-photo-video-gallery plugin if a patched version is unavailable and gallery functionality is not business-critical

bash

# Configuration example
wp plugin update gt3-photo-video-gallery --version=latest
wp plugin deactivate gt3-photo-video-gallery  # if no patched version is available