Photo Gallery EUVD-2026-48122

Exploitation requires an authenticated WordPress user session with at minimum Author-level role (CVSS PR:L confirmed). The attacker must have the ability to create or edit Photo Gallery plugin content - specifically access to input fields within the gt3-photo-video-gallery plugin interface (e.g., gallery creation or image metadata editing). Victim interaction is required (CVSS UI:R): a separate user, typically with higher privileges such as an Editor or Administrator, must load the page rendering the poisoned gallery content in their browser. Limiting factors include: the Author-role authentication prerequisite preventing unauthenticated exploitation; the dependency on a victim loading the affected content (precluding fully automated mass exploitation); and the requirement that the GT3 Themes Photo Gallery plugin be installed and active on the WordPress site. The vulnerability does not affect WordPress core or other plugins.

The CVSS 6.5 Medium score reflects a meaningful but bounded risk profile. The PR:L metric confirms exploitation requires an authenticated WordPress Author account - unauthenticated or anonymous exploitation is not possible. UI:R means a victim must actively view the poisoned gallery content, introducing a social engineering or timing dependency. The S:C scope change is the most consequential signal: it indicates that a low-privileged Author can indirectly compromise a higher-privileged administrator, creating a viable privilege escalation path. EPSS data was not provided in the intelligence feed, so probability-based exploitation likelihood cannot be quantified. No CISA KEV listing and no reported public POC reduce immediate urgency relative to actively exploited vulnerabilities. Real-world risk is most acute for WordPress installations where multiple untrusted or semi-trusted Author accounts exist, or where Author-role credentials have been compromised. Organizations with tightly controlled author populations face materially lower risk.

An attacker with a compromised or legitimately held WordPress Author account navigates to the Photo Gallery plugin's content editor and injects a JavaScript payload (e.g., a cookie-stealing script via document.cookie) into a gallery title or image caption field. When a site administrator later opens the WordPress dashboard or front-end gallery page to review or publish the content, the stored script executes in the administrator's browser, exfiltrating their session cookie to an attacker-controlled endpoint and enabling the attacker to assume full administrative control of the WordPress site. No public exploit code is known at time of analysis, but the attack technique is well-understood and the barrier to exploitation is low once Author credentials are obtained.