CVE-2026-107323: Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS
Published Oct 10, 2026
·Updated
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
Affected Software
1 affected component
Gallery PhotoBlocks<1.3.6
Event History
Oct 10, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:16 AM
Description
Frequently Asked Questions
1
Who can exploit this issue, and who is affected by the payload?
A user with Contributor-level access or higher can store JavaScript in a gallery setting. The script runs in the browser of anyone viewing a page that contains the affected gallery, including administrators.
2
Which plugin versions are affected?
Gallery PhotoBlocks versions before 1.3.6 are affected.