CVE-2026-114710
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Gallery PhotoBlocks plugin for WordPress in versions up to and including 1.3.7 has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The flaw allows stored XSS.
Risk Assessment
An attacker can inject a malicious script that executes in the browser of a user visiting the site. This may lead to session theft or actions performed on behalf of the victim.
Recommendation
Update the Gallery PhotoBlocks plugin to a version later than 1.3.7. Consider implementing additional XSS protections such as a CSP policy.
Other vulnerabilities in Gallery PhotoBlocks
See all- CVE-2026-116408Medium
The WordPress Gallery PhotoBlocks plugin (photoblocks-grid-gallery) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.3.7.
- CVE-2026-107323Medium
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
- CVE-2026-84781Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
- CVE-2026-66448Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks versions up to 1.3.3.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS