CVE-2026-66448
MediumCVSS 6.5Summary
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks versions up to 1.3.3.
Risk Assessment
A contributor can inject malicious scripts that may be executed in other users' browsers, leading to session theft or other attacks.
Recommendation
Update the Gallery PhotoBlocks plugin to the latest patched version.
Other vulnerabilities in Gallery PhotoBlocks
See all- CVE-2026-107323Unknown
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
- CVE-2026-84781Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS