Gallery PhotoBlocks CVE-2026-84781

Exploitation requires the attacker to hold at minimum a WordPress Contributor role on the target installation - anonymous or unauthenticated users cannot exploit this vulnerability. The target site must be running Gallery PhotoBlocks plugin version 1.3.4 or earlier. A victim with higher privileges (Editor, Administrator, or equivalent) must subsequently load the page or dashboard view containing the attacker's malicious gallery block (UI:R). Sites that disable open user registration or restrict Contributor role assignment to trusted individuals significantly limit the attacker pool. No non-default plugin configuration is required beyond the plugin being active.

The 6.5 CVSS base score reflects a moderate-severity stored XSS: exploitable remotely with low complexity, but requiring a Contributor-level WordPress account (PR:L) and victim interaction (UI:R). The real-world risk is most significant in WordPress deployments that allow open or loosely-controlled contributor registration - in those environments an attacker could self-register as a contributor and plant persistent XSS payloads targeting administrators. The scope change (S:C) elevates impact because the script executes in an admin's authenticated browser session, enabling account takeover or privilege escalation beyond the contributor role. EPSS data is not available in the provided intelligence; no KEV listing exists and no public exploit code has been identified. The A:L (Availability: Low) metric in the original CVSS vector is atypical for a stored XSS and may overstate availability impact - XSS typically achieves C and I effects, not availability degradation. This is noted as a potential scoring anomaly. Overall priority is moderate: high in open-registration WordPress sites, low in tightly controlled contributor environments.

An attacker registers or compromises a WordPress Contributor account on the target site, then creates or edits a gallery block and embeds a JavaScript payload within an insufficiently sanitized field. When an administrator subsequently views or reviews the gallery in the WordPress dashboard, the stored script executes in the admin's browser session, allowing the attacker to exfiltrate session cookies, create a rogue administrator account, or perform authenticated actions on behalf of the victim.