Photonic Gallery CVE-2026-97290

Exploitation targets the Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin at versions ≤3.36 via a Cross-Site Scripting flaw (CWE-79). Although unauthenticated (PR:N), successful exploitation requires user interaction (UI:R) - a victim must load attacker-supplied content or a crafted link that reaches the vulnerable plugin output path - which is the primary limiting factor. Impact is confined to the browser/client context (scope-changed S:C) rather than direct server compromise, and realistic high-value impact depends on targeting an authenticated administrator's session. The plugin must be installed and actively rendering the affected gallery/lightbox functionality on a reachable page.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) describes a network-reachable, low-complexity, unauthenticated (PR:N) reflected/stored XSS requiring victim interaction (UI:R) with a scope change (S:C) reflecting script execution in the browser security context rather than the WordPress server. This is a typical Patchstack-reported WordPress plugin XSS: severity is moderate, not critical. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'unauthenticated' qualifier (PR:N) combined with UI:R means an attacker must lure or trick a user into triggering the malicious input/link, which meaningfully limits mass, automated exploitation despite the network vector. Realistically this is a lower-priority patch-when-convenient issue for most sites, elevated only where the plugin is public-facing and admin sessions are exposed. Note the impact metrics (C:L/I:L/A:L) are the conservative XSS-typical values Patchstack commonly assigns; actual impact depends on whether an authenticated admin can be targeted (session/credential theft, admin action forgery), which would raise real-world consequence beyond the 'Low' sub-scores.

An attacker crafts a URL or gallery-related input containing a malicious script payload targeting the Photonic plugin's output handling, then delivers it to a victim (e.g., via a link or a page rendering attacker-controlled content). When the victim's browser renders the unsanitized output, the script executes in the site's context, enabling session/cookie theft or actions on behalf of the victim. No proof-of-concept was provided in the source data, and exploitation requires the victim to interact with the crafted content (UI:R).