A reflected cross-site scripting vulnerability in the GT3 Photo Gallery plugin allows unauthenticated attackers to execute arbitrary scripts in a user's browser.

This vulnerability is classified as CWE-79 (Cross-site Scripting) and occurs because the plugin fails to properly sanitize input. An unauthenticated attacker can craft a malicious link that, when clicked by an unsuspecting user, executes arbitrary code within the context of the user's session.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of the user, and the potential theft of sensitive session cookies or credentials. With a CVSS score of 7.1, this represents a high-severity risk to the integrity and confidentiality of user interactions within the WordPress environment.

Immediate Action: Currently, there is no official patch listed; administrators should monitor the official WordPress plugin repository for an update beyond version 2.7.7.26 and apply it immediately upon release.

Proactive Monitoring: Security teams should review web server access logs for anomalous URL parameters containing script tags or encoded characters that may indicate XSS probing.

Compensating Controls: Implement a Web Application Firewall (WAF) with robust XSS protection rules to identify and block malicious payloads targeting the vulnerable plugin parameters.

Public Exploit Available: No.

Given the high CVSS score and the potential for account takeover via script injection, this vulnerability poses a significant risk to site security. Administrators are strongly advised to keep a close watch on the vendor advisory and to restrict access to pages utilizing this plugin until a security update is officially released and installed.