CVE-2026-66448
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks versions up to 1.3.3.
Risk Assessment
A contributor can inject malicious scripts that may be executed in other users' browsers, leading to session theft or other attacks.
Recommendation
Update the Gallery PhotoBlocks plugin to the latest patched version.
Other vulnerabilities in Gallery PhotoBlocks
See all- CVE-2026-116408Medium
The WordPress Gallery PhotoBlocks plugin (photoblocks-grid-gallery) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.3.7.
- CVE-2026-114710Medium
The Gallery PhotoBlocks plugin for WordPress in versions up to and including 1.3.7 has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The flaw allows stored XSS.
- CVE-2026-107323Medium
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
- CVE-2026-84781Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS