Photonic Gallery & Lightbox vulnerabilities

3 known CVE vulnerabilities in Photonic Gallery & Lightbox, translated and rated.

CVE-2026-97290High
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions up to 3.36.
CVE-2026-66434Medium
The Photonic Gallery & Lightbox plugin up to version 3.33 contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. This allows injection of malicious scripts.
CVE-2025-12691Medium
The Photonic Gallery & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox functionality in all versions up to and including 3.21 due to insufficient input sanitization and output escaping on user supplied caption attribute.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS