Gallery Photoblocks
Monthly
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks plugin for WordPress, affecting versions through 1.3.7, allows a user holding a low-privilege WordPress account to persist malicious markup that executes in the browser of anyone who later views the affected gallery page. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) reflects a network-reachable flaw that requires an authenticated low-privilege account and victim interaction, but whose scope change means the injected script can act beyond the vulnerable plugin component. There is no CISA KEV entry and no public exploit identified at time of analysis, and Patchstack's advisory is the underlying report; the vulnerable field or parameter is not described in the available sources.
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks WordPress plugin, affecting versions through 1.3.7, lets an authenticated low-privileged user persist script payloads that run in another user's browser when the affected gallery content is rendered. CVSS 3.1 rates it 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the scope change reflecting that impact lands in the viewer's session rather than in the plugin itself. No public exploit code has been identified at time of analysis, and no fixed version appears in the available sources, so the vendor's Patchstack advisory remains the authoritative reference for remediation status.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks plugin for WordPress, affecting versions through 1.3.7, allows a user holding a low-privilege WordPress account to persist malicious markup that executes in the browser of anyone who later views the affected gallery page. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5) reflects a network-reachable flaw that requires an authenticated low-privilege account and victim interaction, but whose scope change means the injected script can act beyond the vulnerable plugin component. There is no CISA KEV entry and no public exploit identified at time of analysis, and Patchstack's advisory is the underlying report; the vulnerable field or parameter is not described in the available sources.
Stored cross-site scripting in the WP Chill Gallery PhotoBlocks WordPress plugin, affecting versions through 1.3.7, lets an authenticated low-privileged user persist script payloads that run in another user's browser when the affected gallery content is rendered. CVSS 3.1 rates it 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), with the scope change reflecting that impact lands in the viewer's session rather than in the plugin itself. No public exploit code has been identified at time of analysis, and no fixed version appears in the available sources, so the vendor's Patchstack advisory remains the authoritative reference for remediation status.
Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.
Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.
Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerabilities in WPChill Gallery PhotoBlocks plugin <= 1.2.6 at WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.