CVE-2025-69084: 
WordPress vulnerability analysis and mitigation

CVE-2025-69084 is a Reflected Cross-Site Scripting (XSS) vulnerability in the GT3 themes Photo Gallery WordPress plugin (gt3-photo-video-gallery). It affects all versions from n/a through 2.7.7.26 and was disclosed on January 6, 2026, by Patchstack. The vulnerability is classified under CWE-79 and carries a CVSS v3.1 base score of 7.1 (High), assigned by Patchstack (Patchstack, NVD).

The vulnerability stems from improper neutralization of user-supplied input during web page generation (CWE-79), allowing malicious scripts to be reflected back to users via crafted HTTP requests. As a Reflected XSS, the attack requires the victim to interact with a specially crafted URL or request that includes the malicious payload, which is then executed in the victim's browser within the context of the affected WordPress site. No authentication is required by the attacker, but user interaction is necessary for exploitation (Patchstack, NVD).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session cookie theft, credential harvesting, redirection to phishing sites, or defacement of content visible to the victim. The CVSS scope is marked as "Changed," indicating the impact extends beyond the vulnerable component itself, affecting the user's browser environment (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-69084. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the GT3 Photo Gallery plugin (gt3-photo-video-gallery) version 2.7.7.26 or earlier using tools like WPScan or Shodan.
2. Craft malicious URL: Construct a URL targeting the vulnerable plugin endpoint that includes a reflected XSS payload in an unsanitized parameter (e.g., https://target-site.com/?plugin_param=<script>alert(document.cookie)</script>).
3. Deliver payload: Send the crafted URL to a victim via phishing email, social engineering, or by embedding it in a malicious link on another site.
4. Achieve script execution: When the victim clicks the link and loads the page, the injected script executes in their browser within the context of the WordPress site, enabling cookie theft, session hijacking, or further malicious actions (Patchstack).

• Network: HTTP requests to WordPress pages with URL parameters containing encoded JavaScript payloads (e.g., <script>, %3Cscript%3E, javascript:, onerror=, onload=) targeting the gt3-photo-video-gallery plugin endpoints.
• Logs: WordPress or web server access logs showing GET/POST requests with suspicious script-like strings in query parameters associated with the gt3-photo-video-gallery plugin.
• Browser/Client-Side: Unexpected JavaScript execution, redirects to unknown domains, or unauthorized cookie access reported by users visiting affected WordPress pages.

WordPress site administrators should update the GT3 Photo Gallery plugin to version 2.7.7.27 or later, which contains the fix for this vulnerability. If an immediate update is not possible, consider temporarily deactivating the plugin to eliminate the attack surface. Additionally, deploying a Web Application Firewall (WAF) with XSS filtering rules can help mitigate exploitation attempts in the interim (Patchstack).