EUVD-2026-96774
GHSA-pgv8-gvc5-v6h7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running SmugMug Embed ≤3.13
-
DeliverySend unauthenticated AJAX request storing XSS payload
-
ExploitAwait administrator opening settings screen
-
ExecutionScript executes in admin session
-
PersistCreate rogue admin / hijack session
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable condition is an AJAX action in SmugMug Embed (through 3.13) that stores gallery data with NO authorisation check and NO CSRF nonce, combined with missing output sanitisation/escaping - so any unauthenticated remote user can plant a stored script against the default plugin configuration. The critical LIMITING factor is user interaction (CVSS UI:R): the payload executes only when a logged-in administrator views the SmugMug Embed settings screen, meaning exploitation is not instantaneous and depends on admin behaviour. The site must also actually have the plugin installed and at version ≤3.13. |
| Impact | This is a genuinely actionable issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) confirms a network-reachable, low-complexity, unauthenticated attack, and publicly available exploit code from WPScan lowers the barrier to weaponization. The key tempering signal is UI:R: the stored payload only fires when an administrator opens the SmugMug Embed settings screen, so this is a deferred stored-XSS rather than instant RCE. It is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of widespread active exploitation yet - treat active-exploitation status as UNKNOWN. I disagree with NVD's C:H/I:H/A:H impact rating: those values appear to model the downstream admin-account-takeover a successful XSS can enable, whereas the direct technical impact of script execution in a browser is better captured as limited confidentiality/integrity with a scope change. Net: real priority for any site running this plugin because exploit code is public and planting the payload needs no auth, but realistic impact hinges on admin interaction and on the plugin actually being installed. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the plugin's unprotected AJAX action, storing a malicious JavaScript payload in the gallery data (no login or CSRF token required). When a site administrator later opens the SmugMug Embed settings screen, the unsanitized payload executes in their authenticated session - typically used to create a rogue admin account or exfiltrate session cookies. A public proof-of-concept is available via WPScan, so exploitation requires little attacker skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Stored cross-site scripting in the SmugMug Embed WordPress plugin through 3.13 allows unauthenticated remote users to store arbitrary gallery data via an AJAX action that lacks authorization and CSRF checks, with the payload executing when a logged-in administrator views the plugin's settings screen. Publicly available exploit code exists, but the independent assessment keeps impact limited: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring administrator interaction and yielding low confidentiality and integrity impact. There is no CISA KEV confirmation in the provided data, so this should be treated as exploitable via public PoC rather than confirmed actively exploited.
RemediationAI
No vendor-released patch version is identified in the provided intelligence at time of analysis; check the WPScan advisory and the WordPress plugin repository for an updated SmugMug Embed release beyond 3.13 before upgrading. If no fixed version is available, the safest compensating control is to deactivate and remove the SmugMug Embed plugin, accepting loss of gallery embedding functionality. If the plugin must stay active, restrict access to wp-admin and the plugin settings screen to trusted administrators, and add a small must-use plugin that enforces check_ajax_referer() and current_user_can('manage_options') on the vulnerable AJAX action and escapes stored gallery output with esc_html()/esc_attr(); this may break the plugin's intended AJAX flow and requires maintenance. Additional temporary controls include WAF rules blocking unauthenticated POSTs to admin-ajax.php for that action and close monitoring of plugin settings data; trade-offs include possible false positives for legitimate traffic and no complete elimination of stored XSS risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-79 stored XSS in the SmugMug Embed WordPress plugin's AJAX handler. WordPress plugins commonly expose AJAX actions through admin-ajax.php; if the action is registered for unauthenticated users and lacks a nonce check via check_ajax_referer() or a capability check via current_user_can(), remote users can submit data without authorization. Here the same handler stores gallery data without sanitization, and the plugin later outputs that data in its settings screen without escaping, so script executes in an administrator's browser context. The CPE cpe:2.3:a:unknown:smugmug_embed:*:*:*:*:*:*:*:* shows an unregistered vendor with all versions, and EUVD identifies the affected range as SmugMug Embed 0 through 3.13. The independent assessment vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N confirms the unauthenticated network reachability and required UI:R administrator view, while scoping impact to low confidentiality/integrity and no availability loss rather than the high-CIA profile in the supplied base score.
Know when Smugmug Embed gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated remote storage (PR:N/AV:N/AC:L) but payload runs only when an admin views settings (UI:R); stored XSS crosses into the browser context (S:C) with limited direct C/I impact and no availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.
Technical POC Analysis
Evidence base: the WPScan vulnerability entry only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A high-severity stored cross-site scripting flaw in the SmugMug Embed WordPress plugin (all versions through 3.13) allows an unauthenticated attacker to plant malicious content that executes in an administrator's browser the moment that administrator opens the plugin's settings screen. Publicly available exploit code exists, meaning any internet-facing WordPress site running this plugin is a reachable target without credentials or prior access. Because the payload runs inside a privileged admin session, a successful attack can pivot from a single page view to manipulation of site content, injection of additional administrative accounts, or broader compromise of the hosting environment, so leadership should treat this as a site-integrity and brand-trust exposure with a short response window.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the SmugMug Embed plugin (all versions through 3.13); if it must remain active, restrict access to wp-admin and the plugin settings screen by IP allowlist or VPN, block unauthenticated AJAX requests to the plugin's endpoints at the WAF or reverse proxy, enforce multi-factor authentication for all administrator accounts, disable the plugin/theme file editor, apply least-privilege role assignments, and monitor admin account creation and settings changes for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Exploit-DB