CVE-2026-88826
Received Received - Intake

Stored Cross-Site Scripting in SmugMug Embed WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-88826
EUVD
EUVD-2026-96774

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown SmugMug Embed 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the SmugMug Embed WordPress plugin version 3.13 or earlier. It allows attackers to inject malicious scripts without authentication due to missing authorization and CSRF checks on an AJAX action storing gallery data. The plugin does not sanitize or escape this data, causing scripts to execute when an administrator views the plugin's settings screen.

Detection Guidance

Check if the SmugMug Embed WordPress plugin version 3.13 or earlier is installed. Look for unauthorized stored scripts in the plugin's settings or database entries related to gallery data.

Impact Analysis

An attacker could exploit this to inject malicious scripts into your WordPress site, potentially stealing sensitive data like admin credentials or session tokens. Since the scripts run when an admin views the plugin's settings, it could lead to further compromise of your site or user accounts.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. If exploited, it may result in unauthorized access to personal or health information, leading to legal penalties and reputational damage.

Mitigation Strategies

Update the SmugMug Embed WordPress plugin to the latest version if available. If no update is available, consider disabling the plugin until a patch is released. Monitor for suspicious activity in plugin settings or database entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart