Live › vulnerability › CVE-2026-114710
Go to dashboardThe Gallery PhotoBlocks WordPress plugin by WP Chill does not neutralize input when generating pages, so stored cross-site scripting is possible. An attacker with rights to add content can plant script that runs in other visitors' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 17:31 UTC. All times on this page are UTC.
WordPress sites running Gallery PhotoBlocks version 1.3.7 or older. The flaw is stored XSS, so the risk is highest where users other than administrators can submit or edit gallery content. Sites that do not run the plugin can skip it.
No product ranges from the sources yet.
wp plugin get photoblocks-grid-gallery --field=version1.3.7, if one is released; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-114710")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.