EUVD-2026-49248
GHSA-69fv-cwpj-w5qj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as contributor
-
DeliveryInject XSS via photoblocks input
-
ExploitVictim visits page with crafted gallery
-
ExecutionJavaScript executes in victim's browser
-
ImpactImpact: data theft or session hijacking
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation specifically requires an attacker to have contributor-level privileges (PR:L) on the WordPress site and a victim to interact with a page containing the injected content (UI:R). No remote anonymous attack is possible; the flaw only triggers when a contributor-supplied input is rendered to other users. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L results in a medium base score of 6.5. No EPSS score or CISA KEV listing is available, and no public exploit has been identified, indicating low real-world urgency. The requirement for an authenticated contributor account and victim user interaction significantly limits the attack surface compared to a remote, unauthenticated flaw. The risk is therefore moderate for sites that allow untrusted users to have contributor roles, but low for most environments. |
| Exploit ScenarioDerived | A malicious contributor injects a crafted XSS payload into a photoblock gallery field, such as a description or alt text. When an administrator or another user views that gallery on the frontend, the script executes in their browser, potentially stealing session cookies or performing administrative actions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
RemediationAI
Upgrade Gallery Photoblocks to a version newer than 1.3.3 as soon as a patched release becomes available. The Patchstack advisory suggests that a fix is being addressed; monitor the plugin's official update channel. In the interim, consider restricting contributor access to trusted users only or disabling the gallery interface for contributors if feasible. Note that removing the plugin entirely may affect existing gallery content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Gallery Photoblocks plugin (CPE cpe:2.3:a:wp_chill:gallery_photoblocks:*), which provides a grid gallery builder for WordPress. The root cause is improper neutralization of user input during web page generation, classified as CWE-79 (Cross-site Scripting). Input from users with the Contributor role is not sufficiently sanitized before being output on gallery pages, allowing stored or reflected XSS.
Know when Gallery Photoblocks gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor privileges required and victim must interact, leading to changed scope with low impacts.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Gallery Photoblocks
View allCross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. Rated hig
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. Ra
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contrib
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks plugin for WordPress, affecting versions through 1.3.7,
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks WordPress plugin, affecting versions through 1.3.7, lets
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6
Exploit-DB