CVE-2026-114710: WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Chill Gallery PhotoBlocksto a version that resolves this vulnerability.Fixed in 1.3.8
Event History
Frequently Asked Questions
What access and interaction are required to exploit this issue?
The vector indicates network exploitation with low attack complexity, but an attacker needs low-level privileges and a user must interact with the malicious content. The issue can affect confidentiality, integrity, and availability beyond the vulnerable component's security scope.
Which Gallery PhotoBlocks versions are affected?
Gallery PhotoBlocks versions through 1.3.7 are affected. The available data does not identify a fixed version.
What should teams do if they cannot confirm a patched release?
Limit low-privileged access to the WordPress site and review content or plugin inputs submitted by those users, since exploitation requires low privileges and user interaction. The provided data does not specify a vendor workaround or mitigation.