Gallery PhotoBlocks EUVD-2026-96128

Requires an authenticated WordPress account with Contributor-level role or higher on a site running Gallery PhotoBlocks before 1.3.6, and the ability to edit the affected gallery setting whose value is output unescaped into an HTML attribute. Exploitation is NOT self-triggering: a victim (typically an administrator or other user) must view a page containing the malicious gallery (UI:R) for the stored payload to execute. Limiting factors that reduce real-world risk: it is not unauthenticated (an attacker needs at least Contributor access, so sites that do not grant untrusted users posting roles are largely unaffected), it depends on victim interaction (viewing the gallery page), and it is fixed in 1.3.6.

This is a stored (persistent) Cross-Site Scripting flaw (CWE-79) with a vendor/NVD CVSS 3.1 base score of 6.8 (MEDIUM). The input vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) is internally inconsistent with the description and should be treated with caution: it specifies PR:H (high privilege) and S:U with full C:H/I:H/A:H impact, yet the description explicitly states exploitation requires only Contributor-level access - a LOW-privilege authenticated WordPress role - and the impact of a stored XSS is confidentiality/integrity of the victim's browser session, not unscoped full-system compromise. This points to PR:L (not PR:H) and a scope change (S:C) with limited C/I impact, which is why my independent assessment lands lower than 6.8. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or automated exploitation. Realistically this is a medium-priority, context-dependent issue rather than an emergency: it matters on multi-author WordPress sites that grant Contributor accounts to semi-trusted users, where a low-privilege author can escalate impact by landing script in an administrator's browser. Single-author or tightly-controlled sites face little practical risk. A patch is available (1.3.6), which makes remediation straightforward.

A multi-author WordPress site grants a semi-trusted user a Contributor account. That user edits a Gallery PhotoBlocks gallery setting, injecting a malicious JavaScript payload that is stored unescaped in an HTML attribute. When an administrator later views any page rendering that gallery, the script executes in their authenticated session, enabling session/cookie theft or admin-level actions. No public exploit code was identified, but the technique is standard stored-XSS and trivial to reproduce.