CVE-2026-116408: WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Chill Gallery PhotoBlocks photoblocks-grid-galleryto a version that resolves this vulnerability.Fixed in 1.3.8
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability has a low-privileges-required vector, so an attacker must have an authenticated account with sufficient ability to submit the affected input. Exploitation also requires a victim to interact with attacker-controlled content.
Which versions are affected?
Gallery PhotoBlocks versions through 1.3.7 are affected. The available data does not identify a fixed version.
What could happen if exploitation succeeds?
This is a stored XSS issue, meaning malicious script can be saved and later executed when a victim views or interacts with the affected page content. The supplied vector indicates potential low impact to confidentiality, integrity, and availability, with impact extending beyond the vulnerable component's security scope.