CVE-2026-115613: WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Q: What level of access and interaction are required for exploitation?

The CVSS vector indicates an attacker needs low privileges and network access. Exploitation also requires user interaction.

Q: What is the potential impact if the vulnerability is exploited?

The vulnerability is rated medium severity with a 6.5 CVSS score. It can have low impact on confidentiality, integrity, and availability, and its scope is changed.

Published Oct 26, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through 2.4.1.

Affected Software

1 affected component

bPlugins Image Gallery block – Create and display photo gallery/photo album<=2.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade 3d-image-gallery to a version that resolves this vulnerability.
Fixed in 2.4.2

Event History

Oct 26, 2026

CVE Published

via MITRE·09:54 AM

Data Sourced

via MITRE·09:54 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access and interaction are required for exploitation?

The CVSS vector indicates an attacker needs low privileges and network access. Exploitation also requires user interaction.

What is the potential impact if the vulnerability is exploited?