CVE-2026-107323
Received Received - Intake

Stored Cross-Site Scripting in Gallery PhotoBlocks WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: WPScan

Description
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-107323
EUVD
EUVD-2026-96128

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Gallery PhotoBlocks 1.3.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Gallery PhotoBlocks WordPress plugin before version 1.3.6. It occurs because the plugin fails to properly sanitize and escape a gallery setting before outputting it into an HTML attribute. This allows users with Contributor-level access or higher to inject malicious JavaScript code into a page.

Detection Guidance

Check the installed version of the Gallery PhotoBlocks plugin. If it is version 1.3.5 or below, the system is vulnerable. Use WordPress admin dashboard or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

The injected JavaScript executes in the browsers of anyone viewing a page containing the affected gallery, including administrators. This could lead to unauthorized actions, data theft, or session hijacking. Attackers could steal sensitive information or take control of user accounts.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA requirements for protecting personal and health data. Organizations could face fines or legal consequences for failing to secure user data adequately.

Mitigation Strategies

Update the Gallery PhotoBlocks plugin to version 1.3.6 or later immediately. Remove or disable the plugin if an update is not available. Review user roles with Contributor-level access or higher for unauthorized scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107323. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart