EUVD-2026-62379
GHSA-hcmw-7p27-79vm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS via network with no auth required and victim interaction; A:N because XSS does not impact server-side availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
AnalysisAI
Unauthenticated reflected or stored Cross-Site Scripting in the Global Gallery WordPress plugin (versions up to and including 11.1.2) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by authenticated users - most critically administrators. With scope changed in the CVSS vector (S:C), successful exploitation can result in session hijacking, credential theft, or unauthorized administrative actions within the WordPress installation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must deliver a crafted URL or page to a victim who is currently authenticated to the WordPress installation - the plugin description specifies 'unauthenticated' from the attacker's perspective (PR:N), but user interaction is required (UI:R), meaning a logged-in user must click a malicious link or visit an attacker-controlled page that triggers the vulnerable parameter. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L accurately reflects a medium-high risk: the attack is network-reachable, requires no privileges, has low complexity, but does require a victim to interact (UI:R), typically by clicking a crafted link or visiting a malicious page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL targeting the vulnerable Global Gallery plugin parameter that embeds a JavaScript payload - for example, a link that causes the plugin to reflect unsanitized input into the page. The attacker distributes this link via phishing email or comment post to a WordPress site administrator. … |
| Remediation | The primary remediation is to update the Global Gallery plugin to the version released after 11.1.2, which Patchstack indicates contains a fix - however, the exact patched version number is not independently confirmed in the available data, so administrators should consult the plugin's changelog on WordPress.org or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/global-gallery/vulnerability/wordpress-global-gallery-plugin-11-1-2-cross-site-scripting-xss-vulnerability to confirm the safe version before updating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable the Global Gallery WordPress plugin on all installations running version 11.1.2 or earlier and audit recent logs for XSS payload injection patterns (check request parameters for script tags or encoded JavaScript). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Global Gallery
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today