CVE-2025-60104
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery Custom Links gallery-custom-links allows Stored XSS.This issue affects Gallery Custom Links: from n/a through <= 2.2.5.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS vulnerability in WordPress Gallery Custom Links plugin ≤2.2.5 allows attackers to inject malicious scripts.
The Gallery Custom Links plugin for WordPress suffers from a stored cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation [1]. This issue affects versions from n/a through 2.2.5.
Exploitation requires a privileged user to perform an action, such as clicking a malicious link or submitting a crafted form [1]. The attacker must be authenticated with the appropriate role to inject the payload.
Successful exploitation allows an attacker to inject malicious scripts, such as redirects, advertisements, or other HTML payloads, which execute when other users visit the affected page [1]. This could lead to defacement, data theft, or further attacks.
A patch is available in version 2.2.6, and users are advised to update immediately [1]. Auto-update can be enabled for vulnerable plugins via Patchstack.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2<= 2.2.5+ 1 more
- (no CPE)range: <= 2.2.5
- (no CPE)range: <= 2.2.5
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.