Gallery PhotoBlocks CVE-2026-116408

Exploitation requires an authenticated WordPress account with at least low-level posting privileges (PR:L) able to submit or edit gallery content handled by the Gallery PhotoBlocks plugin, affecting versions up to and including 1.3.7. The payload is stored and only triggers when another user - typically an administrator or site visitor - loads the page rendering the unsanitized input (UI:R), which limits exploitation to scenarios where a victim views the malicious content. Exploitation is therefore gated by the need for a valid low-privilege account and victim interaction; the specific vulnerable field/parameter is not described in the available sources.

This is a moderate-severity stored XSS (CVSS 6.5) in the WordPress plugin Gallery PhotoBlocks, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates network-reachable but authenticated exploitation (PR:L) that also requires victim interaction (UI:R), with a scope change (S:C) reflecting that injected script runs in the context of other users such as an administrator. The low, partial impacts across confidentiality, integrity and availability (C:L/I:L/A:L) are typical of a stored XSS rather than a direct server compromise. No EPSS score, no CISA KEV listing, and no confirmed proof-of-concept are present in the input; the sole reference is the Patchstack advisory, which is an advisory record, not verified working exploit code. The vuln.today decision label is 'this_month', signalling routine patch prioritization rather than emergency action. On balance this is a real but bounded issue: the authentication requirement (PR:L), the need for an admin/other-user to view the malicious content (UI:R), and the absence of any exploitation evidence argue against treating it as an urgent, widely-exploited threat, while the scope change and stored nature mean it should still be remediated on a normal maintenance cycle.

An attacker holding a low-privileged WordPress account (e.g. contributor/author) submits gallery content containing a malicious script payload, which is stored and later rendered without proper neutralization. When an administrator or other user views the affected gallery page, the script executes in their browser session, potentially enabling session hijacking or admin-context actions. No public exploit was identified at the time of analysis; the trigger parameter is not described in the available sources.