6.8 Medium

CVE-2026-107323 The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before…

Description

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.

Affected products and versions

Product	Affected versions	Fixed in
Gallery PhotoBlocks 1.3	1.3.5 → < 1.3.6	1.3.6

Do you use Gallery PhotoBlocks?

Track this CVE Watch Gallery PhotoBlocks Check my SBOMs

www.cveye.io/en/cve/CVE-2026-107323

Timeline

Published October 10, 2026
Last modified October 10, 2026

References

wpscan.com wpscan.com

Track this CVE