CVE-2026-66434
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Photonic Gallery & Lightbox plugin up to version 3.33 contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. This allows injection of malicious scripts.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or alter the appearance of the website.
Recommendation
Update the Photonic Gallery & Lightbox plugin to the latest version that fixes this vulnerability.
Other vulnerabilities in Photonic Gallery & Lightbox
See all- CVE-2026-97290High
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions up to 3.36.
- CVE-2025-12691Medium
The Photonic Gallery & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox functionality in all versions up to and including 3.21 due to insufficient input sanitization and output escaping on user supplied caption attribute.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS