What’s Vulnerable › Vulnerabilities
CVE-2026-107323: Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-10 · updated 2026-10-13
- Weakness: CWE-79
Description
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
Affected products
- Gallery PhotoBlocks: from 1.3.5 before 1.3.6 — fixed in 1.3.6
How to fix
Upgrade to a fixed version: Gallery PhotoBlocks 1.3.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-107323 or the next vulnerability affects your stack