Gallery PhotoBlocks EUVD-2026-109992

Exploitation requires an authenticated account with at least low privileges (CVSS PR:L) that can submit data to the plugin, plus subsequent user interaction (UI:R) - a victim such as an administrator or site visitor must load the page rendering the stored payload for the script to fire. The available sources do not name the exact Gallery PhotoBlocks field, setting, or feature that accepts the unsanitized input, so the precise injection vector is not described in the available sources. Limiting factors: the attacker cannot act fully unauthenticated, the payload only triggers when a victim views the affected content, and the plugin must be installed and active; the scope change (S:C) means impact lands in the viewer's context. No fixed version is listed in the provided data, so updating cannot be confirmed as an available remediation from input alone.

This is a moderate-severity Stored XSS (CWE-79) in the Gallery PhotoBlocks WordPress plugin, scored CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. Per the CVSS vector, exploitation is network-based and low-complexity but requires an authenticated account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in another user's browser/security context. The vuln.today decision label is 'this_month', indicating a routine-priority patch item rather than an emergency. No EPSS score was supplied, the CVE is not listed in CISA KEV, and the only reference is the Patchstack advisory - not verified working exploit code - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of partial C/I/A impact (each :L), required privileges, and required user interaction keeps real-world risk moderate: this is a legitimate hygiene fix, not a drop-everything emergency. Missing signals to note explicitly: EPSS probability is absent, and no fixed version is disclosed in the available data ('from n/a through 1.3.7'), so remediation status cannot be confirmed from input alone.

An attacker with a low-privileged authenticated account (e.g., contributor/author-level) submits a crafted payload into a Gallery PhotoBlocks input that is stored without proper neutralization. When an administrator or other user later views the page or admin screen rendering that gallery data, the script executes in their browser session (scope change), enabling actions such as session/cookie theft or admin-context operations. No public exploit code is identified at time of analysis; only a Patchstack advisory reference exists.