CVE-2026-107323
Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
| Vendor | unknown |
| Product | gallery photoblocks |
| Published | Oct 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown gallery photoblocks
Be the first to know when new unknown vulnerabilities affecting unknown gallery photoblocks are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Gallery PhotoBlocks
1.3.5 < 1.3.6
References
Credits
Andy Urlep WPScan