What is the CVSS score of CVE-2026-65519?

CVE-2026-65519 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Photo Gallery CVE-2026-65519

EUVD-2026-48122 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-29hm-3rfg-r56r

WordPress XSS Photo Gallery Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Author-role authentication (PR:L) and victim page-load (UI:R) required; scope change reflects cross-user session impact; availability impact removed as XSS does not cause denial of service.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:14 vuln.today

DescriptionCVE.org

Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.

AnalysisAI

Stored Cross-Site Scripting in the GT3 Themes Photo Gallery WordPress plugin (versions <= 2.7.7.29) allows authenticated users holding at minimum the Author role to inject persistent malicious JavaScript into gallery content. When a privileged user such as an administrator subsequently views the affected gallery, the injected script executes in their browser context, enabling session hijacking or unauthorized administrative actions. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the scope change (S:C) elevates practical risk by enabling privilege escalation from Author to Administrator.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize user-supplied content before embedding it in HTML output. The affected product is the GT3 Themes Photo Gallery plugin for WordPress (CPE: cpe:2.3:a:gt3themes:photo_gallery:*:*:*:*:*:*:*:*), a media gallery plugin that allows authors to create and manage photo and video galleries. The 'Author' label in the CVE title indicates the injection point lies within the author-facing gallery creation or editing interface - likely a field such as gallery title, image caption, or alt text - where input is stored without adequate escaping and later rendered verbatim in pages served to other users. The CVSS scope change (S:C) confirms that the impact crosses security boundaries: content entered by one user (Author) affects the browser session of another user (e.g., Administrator), which is the defining characteristic of stored/persistent XSS.

RemediationAI

Update the GT3 Themes Photo Gallery plugin to a version beyond 2.7.7.29 as soon as a patched release is confirmed by the vendor or Patchstack. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/gt3-photo-video-gallery/vulnerability/wordpress-photo-gallery-plugin-2-7-7-29-cross-site-scripting-xss-vulnerability should be monitored for the specific patched version number, which was not independently confirmed from available data. As a compensating control prior to patching, restrict the Photo Gallery plugin's content creation capabilities to fully trusted Author accounts only - remove or demote any Author-role accounts that are not operationally necessary. Deploying a WordPress WAF rule (e.g., via Wordfence or Patchstack Firewall) targeting XSS payloads in gallery input fields can block exploitation attempts without requiring immediate plugin update; trade-off is potential false positives on legitimate rich-text content. Reviewing existing gallery entries for suspicious script tags is advisable if untrusted Authors have had access.