What is the CVSS score of CVE-2026-57755?

CVE-2026-57755 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Mosaic Gallery CVE-2026-57755

Q: Which versions of Mosaic Gallery are affected by CVE-2026-57755?

Stored or reflected Cross-Site Scripting in the Mosaic Gallery - Advanced Gallery WordPress plugin (versions <= 1.2.0) is exploitable by authenticated users holding a Contributor role.

EUVD-2026-41311 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-7895-6924-w5f6

WordPress XSS Wordpress Plugin Mosaic Gallery 8211 Advanced Gallery

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor authentication required (PR:L), scope changes to victim browser (S:C); XSS does not directly cause availability impact so A:N is more accurate.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:29 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Mosaic Gallery – Advanced Gallery <= 1.2.0 versions.

AnalysisAI

Stored or reflected Cross-Site Scripting in the Mosaic Gallery - Advanced Gallery WordPress plugin (versions <= 1.2.0) is exploitable by authenticated users holding a Contributor role. A Contributor-level attacker can inject malicious JavaScript into gallery content, which executes in the browsers of higher-privileged users - such as editors or administrators - who subsequently view the affected page, enabling session hijacking or unauthorized administrative action. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input is rendered into HTML output without adequate sanitization or encoding. The Mosaic Gallery - Advanced Gallery plugin (CPE: cpe:2.3:a:misbah_wp:mosaic_gallery_-_advanced_gallery:*:*:*:*:*:*:*:*), developed by misbah_wp, provides image gallery functionality within WordPress. In WordPress, the Contributor role can draft and submit content including shortcodes or block attributes but cannot publish independently. If gallery-related input fields fail to sanitize stored or reflected values, a Contributor can persist a payload that fires whenever a privileged user (editor, admin) renders that content. The CVSS scope value S:C confirms the vulnerability crosses the trust boundary of the plugin into the victim's browser execution context.

RemediationAI

Update the Mosaic Gallery - Advanced Gallery plugin to the latest available version via the WordPress plugin repository or per the vendor's published patch, once confirmed beyond version 1.2.0. No exact patched version number is confirmed in the available data - verify the current release at the WordPress plugin directory or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mosaic-gallery-advanced-gallery/vulnerability/wordpress-mosaic-gallery-8211-advanced-gallery-plugin-1-2-0-cross-site-scripting-xss-vulnerability before upgrading. As a compensating control while awaiting a confirmed patch, restrict Contributor role assignment to fully trusted users only and audit existing accounts for unrecognized contributors; this eliminates the PR:L attack vector entirely. Alternatively, temporarily deactivating the plugin removes the vulnerable attack surface at the cost of disabling gallery functionality.