CVE-2026-116408
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The WordPress Gallery PhotoBlocks plugin (photoblocks-grid-gallery) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.3.7.
Risk Assessment
An attacker could store a malicious script that executes in the browsers of users visiting the site, potentially leading to session theft or account takeover. The risk affects sites using the vulnerable plugin version.
Recommendation
Update the Gallery PhotoBlocks plugin to a version later than 1.3.7. Until then, consider disabling the plugin or restricting content creation capabilities for users.
Other vulnerabilities in Gallery PhotoBlocks
See all- CVE-2026-114710Medium
The Gallery PhotoBlocks plugin for WordPress in versions up to and including 1.3.7 has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The flaw allows stored XSS.
- CVE-2026-107323Medium
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
- CVE-2026-84781Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
- CVE-2026-66448Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks versions up to 1.3.3.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS