Global Gallery CVE-2026-73184

The attacker must deliver a crafted URL or page to a victim who is currently authenticated to the WordPress installation - the plugin description specifies 'unauthenticated' from the attacker's perspective (PR:N), but user interaction is required (UI:R), meaning a logged-in user must click a malicious link or visit an attacker-controlled page that triggers the vulnerable parameter. The Global Gallery plugin must be installed and active on the target WordPress site. No special server configuration beyond plugin activation appears required. What limits exploitation: the requirement for a logged-in victim to interact with attacker-controlled content reduces opportunistic mass exploitation; the attack is most effective when targeted at administrators. The scope change (S:C) means the highest-value impact - administrative takeover - only materialises if the victim has admin-level WordPress privileges.

The CVSS 3.1 score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L accurately reflects a medium-high risk: the attack is network-reachable, requires no privileges, has low complexity, but does require a victim to interact (UI:R), typically by clicking a crafted link or visiting a malicious page. The scope change (S:C) acknowledges that JavaScript executing in a victim's browser can affect the WordPress admin panel - a separate security context - enabling session token theft or admin-level actions. The A:L availability component in the official vector is notable since standard XSS does not typically impact server-side availability; this may reflect client-side disruption (e.g., page breakage) rather than server unavailability, and should be verified with the vendor. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. There is no KEV listing, meaning active exploitation is not confirmed by CISA. The practical risk is meaningful because unauthenticated XSS targeting WordPress admins is a well-trodden attack path - even a mid-sized IT operation in a regional municipality, say radom, would face real risk if administrators are socially engineered into visiting a crafted URL while logged in. The plugin's niche install base limits blast radius compared to core WordPress vulnerabilities.

An attacker crafts a URL targeting the vulnerable Global Gallery plugin parameter that embeds a JavaScript payload - for example, a link that causes the plugin to reflect unsanitized input into the page. The attacker distributes this link via phishing email or comment post to a WordPress site administrator. When the logged-in administrator visits the URL, the injected script executes in their browser, stealing the session cookie or wp-nonce and relaying it to the attacker's server, granting full administrative access to the WordPress installation. No public exploit code is confirmed, but this attack pattern requires no tooling beyond a browser and basic JavaScript knowledge.