CVE-2026-97260: WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
Published Oct 1, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.
Affected Software
1 affected component
MaxGalleria MaxGalleria plugin<=6.5.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress MaxGalleria pluginto a version that resolves this vulnerability.Fixed in 6.5.4
Event History
Oct 1, 2026
CVE Published
via MITRE·02:33 PM
Data Sourced
via MITRE·02:33 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation does require user interaction.
2
Which installations are affected?
MaxGalleria plugin versions 6.5.3 and earlier are affected.
3
What is the potential impact?
Successful exploitation can execute cross-site scripting in a user’s browser and may affect confidentiality, integrity, and availability. The listed vector indicates low impact in each of those areas, with scope changed.