Photo Gallery by Supsystic EUVD-2026-48145

Exploitation requires an authenticated WordPress administrator account (PR:H per CVSS vector), which is a non-default credential not available to unauthenticated internet users. The victim must subsequently load a page containing the affected gallery (UI:R), meaning the attack is not fully automated and depends on user interaction after payload injection. Exploitation is limited to environments running Photo Gallery by Supsystic versions ≤ 1.16.3 with the plugin actively installed and activated. The attack surface is further constrained by however many pages the gallery shortcode is embedded on. No special server configuration or non-default WordPress setting beyond standard plugin activation is required once admin access is obtained.

The CVSS 5.9 Medium score reflects a genuine but constrained risk profile. The PR:H metric is the dominant limiting factor: exploitation is gated behind full WordPress administrator access, meaning this vulnerability cannot be weaponized by unauthenticated attackers or lower-privileged subscribers. The S:C scope change elevates impact beyond the administrator's own session - once a payload is stored, it executes for any user who views the affected gallery page. EPSS data was not provided in source intelligence, preventing quantitative exploitation probability comparison. KEV status is not confirmed, and no POC has been identified. In practical terms, this is a lower-priority issue unless the deployment involves shared hosting environments where multiple parties hold admin credentials, or where the WordPress admin panel is exposed to the internet without additional access controls. The A:L availability metric in the provided vector is atypical for XSS and may reflect script-induced rendering disruption; independent assessment rates this as negligible.

An attacker who holds WordPress administrator credentials - or who compromises an admin account through credential stuffing or phishing - navigates to the Photo Gallery by Supsystic plugin settings and injects a JavaScript payload into a gallery title, caption, or configuration field. The payload is stored in the database and subsequently rendered without encoding when any site visitor loads a page containing the affected gallery, causing the script to execute in the visitor's browser and potentially harvesting session cookies or performing actions on their behalf.