CVE-2026-97290
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions up to 3.36.
Risk Assessment
An attacker can inject malicious scripts into pages, potentially leading to session theft or admin account takeover.
Recommendation
Update the Photonic Gallery & Lightbox plugin to the latest patched version.
Other vulnerabilities in Photonic Gallery & Lightbox
See all- CVE-2026-66434Medium
The Photonic Gallery & Lightbox plugin up to version 3.33 contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. This allows injection of malicious scripts.
- CVE-2025-12691Medium
The Photonic Gallery & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox functionality in all versions up to and including 3.21 due to insufficient input sanitization and output escaping on user supplied caption attribute.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS