Image Gallery Block CVE-2026-115613

Exploitation requires an authenticated WordPress account with at least low-privilege content-creation rights (PR:L - typically contributor/author level able to add or edit an Image Gallery block) on a site running the bPlugins Image Gallery block plugin at version 2.4.1 or earlier. The payload is persisted because plugin input used in web page generation is improperly neutralized, and execution additionally requires victim user interaction (UI:R) - a separate, usually higher-privileged user must view the page containing the stored payload. These two limiting factors (needed authentication and needed victim interaction) constrain realistic exploitation; the exact vulnerable block field or parameter is not described in the available sources.

This is a moderate-severity Stored XSS (CWE-79, CVSS 6.5) in the bPlugins 'Image Gallery block' WordPress plugin (slug 3d-image-gallery), affecting versions from an unspecified start through 2.4.1. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L is internally consistent with a classic authenticated stored XSS: network-reachable, low complexity, but requiring an authenticated low-privilege account (PR:L) and victim interaction (UI:R), with a changed scope (S:C) reflecting script executing in another user's browser context. The real-world signals are muted rather than alarming: there is no CISA KEV listing (so no confirmed active exploitation), no EPSS probability was supplied in the input, and no verified exploit code is referenced - only a Patchstack database advisory. The vuln.today decision label is 'this_month', indicating a routine patch-cycle priority rather than emergency action. Taken together, the signals are coherent and point to a genuine but non-urgent issue: the limiting factors (required authentication at PR:L and required user interaction) meaningfully reduce exploitability versus a raw unauthenticated flaw, so this should be scheduled for patching rather than treated as a drop-everything emergency. EPSS and any mass-exploitation telemetry are absent from the input and cannot be asserted either way.

An attacker who already holds a low-privilege authenticated account (e.g. a contributor or author able to create/edit image gallery content) injects a malicious script payload into a field of the Image Gallery block that is not properly neutralized. The payload is stored and later executes in the browser of another user - typically an administrator or editor - when they view the affected page or post, enabling session/credential theft or actions in that victim's context. No verified working exploit code is referenced; only a Patchstack advisory exists at the time of analysis.