CVE-2026-84781
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
Risk Assessment
Risk of malicious script execution in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the Gallery PhotoBlocks plugin to a version newer than 1.3.4 if a fix is available.
Other vulnerabilities in Gallery PhotoBlocks
See all- CVE-2026-116408Medium
The WordPress Gallery PhotoBlocks plugin (photoblocks-grid-gallery) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.3.7.
- CVE-2026-114710Medium
The Gallery PhotoBlocks plugin for WordPress in versions up to and including 1.3.7 has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The flaw allows stored XSS.
- CVE-2026-107323Medium
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
- CVE-2026-66448Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks versions up to 1.3.3.
Original NVD description (English source)
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS