What is the CVSS score of CVE-2026-24628?

CVE-2026-24628 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Photo Gallery by Supsystic CVE-2026-24628

EUVD-2026-48145 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-qj3m-ffgp-925j

WordPress XSS Wordpress Plugin Photo Gallery By Supsystic Supsystic

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

PR:H reflects mandatory administrator authentication; S:C and UI:R capture the stored-to-visitor delivery chain; A:N because XSS does not meaningfully impact availability in this context.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:00 vuln.today

DescriptionCVE.org

Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.

AnalysisAI

Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-controlled input before it is rendered as HTML or JavaScript in a browser. The affected product, identified via CPE cpe:2.3:a:supsystic:photo_gallery_by_supsystic:*:*:*:*:*:*:*:*, is a WordPress plugin that enables administrators to build photo galleries. Admin-context XSS typically arises when plugin settings fields - such as gallery titles, captions, or configuration options - are stored without adequate output encoding and then rendered to site visitors, creating a stored XSS vector. The PR:H CVSS metric confirms the injection point is accessible only to WordPress administrator-level users.

RemediationAI

Update the Photo Gallery by Supsystic plugin to a version beyond 1.16.3; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/gallery-by-supsystic/vulnerability/wordpress-photo-gallery-by-supsystic-plugin-1-16-3-cross-site-scripting-xss-vulnerability should be consulted to confirm the exact patched release, as an explicit fix version was not included in the available intelligence. An upstream fix is referenced via Patchstack but a specific patched release number was not independently confirmed from the provided data. As a compensating control, restrict WordPress administrator access to the minimum number of trusted accounts and enforce strong authentication (MFA) on admin accounts - this directly limits who can introduce the XSS payload. Additionally, deploy a web application firewall rule to filter script injection patterns in gallery-related POST parameters. Note that WAF rules may produce false positives on legitimate HTML-enabled gallery fields.