CVE-2026-24628
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Photo Gallery by Supsystic plugin versions up to 1.16.3 contain a Cross-Site Scripting (XSS) vulnerability, allowing administrators to inject malicious scripts into pages.
Risk Assessment
The risk involves script execution in other users' browsers, potentially leading to session theft or redirects to malicious sites.
Recommendation
Update the Photo Gallery by Supsystic plugin to a version above 1.16.3 that fixes this vulnerability.
Other vulnerabilities in Photo Gallery by Supsystic
See all- CVE-2026-102399Medium
Unauthenticated Cross Site Request Forgery (CSRF) vulnerability in Photo Gallery by Supsystic versions up to 1.21.0. Allows an attacker to perform unauthorized actions on behalf of a logged-in user.
- CVE-2026-119484Medium
The Photo Gallery by Supsystic plugin for WordPress (up to version 1.21.6) is vulnerable to Cross-Site Request Forgery (CSRF), allowing unwanted actions on behalf of a logged-in user.
Original NVD description (English source)
Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS