WordPress Gallery from files plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress (Wordpress) Foundation using the PHP language. Gallery from files is a plugin for WordPress. WordPress Gallery from files plugin version 1.6.0 and earlier is vulnerable to a cross-site scripting vulnerability that originates when the plugin provides the ability to upload images to server. However, when a file name has an invalid extension, it is not cleaned up properly before being output to an error message. An attacker could exploit the vulnerability to cause a cross-site scripting issue.