CVE-2026-24628

MediumCVSS 5.9

Published: 23/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Photo Gallery by Supsystic plugin versions up to 1.16.3 contain a Cross-Site Scripting (XSS) vulnerability, allowing administrators to inject malicious scripts into pages.

Risk Assessment

The risk involves script execution in other users' browsers, potentially leading to session theft or redirects to malicious sites.

Recommendation

Update the Photo Gallery by Supsystic plugin to a version above 1.16.3 that fixes this vulnerability.

Other vulnerabilities in Photo Gallery by Supsystic

CVE-2026-102399Medium
Unauthenticated Cross Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic versions up to 1.21.0. Allows an attacker to perform unauthorized actions on behalf of a logged-in user.

Original NVD description (English source)

Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS