CVE-2026-57769
HighCVSS 7.1Summary
The Grand Photography plugin version 5.7.8 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
Risk Assessment
The organization is at risk of visitor session theft, redirects to malicious sites, and theft of data related to the photo gallery.
Recommendation
Update the Grand Photography plugin to a version above 5.7.8 that fixes the XSS vulnerability.
Other vulnerabilities in Grand Photography
See all- CVE-2026-57770Critical
The Grand Photography WordPress plugin contains a deserialization of untrusted data vulnerability allowing object injection. This issue affects all versions up to and including 5.7.8.
- CVE-2026-39603Medium
The Grand Photography WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated administrator.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.