CVE-2022-0873: 
WordPress vulnerability analysis and mitigation

The Gmedia Photo Gallery WordPress plugin before version 1.20.0 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2022-0873. The vulnerability was discovered by Kaushalendra Dubey and publicly disclosed on April 25, 2022. The issue affects the plugin's album name handling functionality in the WordPress content management system (WPScan, CVE Mitre).

The vulnerability stems from improper sanitization and escaping of the Album's name before it is output in pages/posts with a media embed. This security flaw exists even when the unfiltered-html capability is disallowed. The vulnerability has been assigned a CVSS score of 3.4 (low severity) and is classified under CWE-79 (Cross-Site Scripting) (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Cross-Site Scripting attacks. When exploited, the XSS payload can be triggered when viewing media posts containing the compromised album name (WPScan).

The vulnerability has been fixed in version 1.20.0 of the Gmedia Photo Gallery plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).