CVE-2026-107323
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
Risk Assessment
An attacker can execute malicious script in an administrator's browser, potentially leading to session hijacking, data theft, or further site compromise.
Recommendation
Update the Gallery PhotoBlocks plugin to version 1.3.6 or later, which includes the security fix.
Other vulnerabilities in Gallery PhotoBlocks
See all- CVE-2026-116408Medium
The WordPress Gallery PhotoBlocks plugin (photoblocks-grid-gallery) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.3.7.
- CVE-2026-114710Medium
The Gallery PhotoBlocks plugin for WordPress in versions up to and including 1.3.7 has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The flaw allows stored XSS.
- CVE-2026-84781Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
- CVE-2026-66448Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks versions up to 1.3.3.
Original NVD description (English source)
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS