CVE-2026-84781
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
Risk Assessment
Risk of malicious script execution in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the Gallery PhotoBlocks plugin to a version newer than 1.3.4 if a fix is available.
Other vulnerabilities in Gallery PhotoBlocks
See all- CVE-2026-107323Unknown
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
- CVE-2026-66448Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks versions up to 1.3.3.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS