CVE-2026-88826: SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums

Q: Who is exposed to script execution?

An administrator is exposed when viewing the plugin's settings screen after malicious gallery data has been stored. The attacker can submit that data without authentication.

Q: What protections are missing from the affected AJAX action?

The saveSelectedAlbums AJAX action lacks both authorization and CSRF checks. It also does not sanitize stored gallery data or escape it before rendering it on the settings screen.

Q: How can I determine whether this issue may already have been exploited?

Review gallery data stored by the plugin and inspect the plugin settings screen for unexpected or script-like content. Because the payload executes when the settings screen is viewed, administrators should take care when opening that screen during investigation.

Published Oct 11, 2026

Updated

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.

Affected Software

1 affected component

SmugMug SmugMug Embed WordPress plugin<=3.13

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who is exposed to script execution?

An administrator is exposed when viewing the plugin's settings screen after malicious gallery data has been stored. The attacker can submit that data without authentication.

What protections are missing from the affected AJAX action?

The saveSelectedAlbums AJAX action lacks both authorization and CSRF checks. It also does not sanitize stored gallery data or escape it before rendering it on the settings screen.

How can I determine whether this issue may already have been exploited?

Review gallery data stored by the plugin and inspect the plugin settings screen for unexpected or script-like content. Because the payload executes when the settings screen is viewed, administrators should take care when opening that screen during investigation.

CVE-2026-88826: SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums

Affected Software

Event History

Frequently Asked Questions

Who is exposed to script execution?

What protections are missing from the affected AJAX action?

How can I determine whether this issue may already have been exploited?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to script execution?

What protections are missing from the affected AJAX action?

How can I determine whether this issue may already have been exploited?