{"id":"CVE-2026-114710","kind":"vulnerability","aliases":["CVE-2026-114710"],"related":[],"title":"WordPress Gallery PhotoBlocks plugin: stored XSS through 1.3.7","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.","summary":"The Gallery PhotoBlocks WordPress plugin by WP Chill does not neutralize input when generating pages, so stored cross-site scripting is possible. An attacker with rights to add content can plant script that runs in other visitors' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of photoblocks-grid-gallery in the WordPress plugins screen or `wp plugin get photoblocks-grid-gallery --field=version`\n- Confirm whether the plugin is active on any site","fix":"- Update photoblocks-grid-gallery to a version later than `1.3.7`, if one is released; the sources do not name a fixed version\n- Until patched, deactivate the plugin or restrict contributor-level accounts","status":"open","published_at":"2026-10-26T17:17:15+00:00","first_seen_at":"2026-10-26T17:31:21+00:00","triaged_at":"2026-10-26T17:33:21+00:00","updated_at":"2026-10-26T17:33:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T17:33:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update photoblocks-grid-gallery to a version later than `1.3.7`, if one is released; the sources do not name a fixed version\n- Until patched, deactivate the plugin or restrict contributor-level accounts","reach":"internet","title":"WordPress Gallery PhotoBlocks plugin: stored XSS through 1.3.7","impact":"medium","summary":"The Gallery PhotoBlocks WordPress plugin by WP Chill does not neutralize input when generating pages, so stored cross-site scripting is possible. An attacker with rights to add content can plant script that runs in other visitors' browsers.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed version and the minimum role needed to inject content from the NVD entry or the WP Chill changelog.","how_to_check":"- Check the installed version of photoblocks-grid-gallery in the WordPress plugins screen or `wp plugin get photoblocks-grid-gallery --field=version`\n- Confirm whether the plugin is active on any site","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"WordPress sites running Gallery PhotoBlocks version 1.3.7 or older. The flaw is stored XSS, so the risk is highest where users other than administrators can submit or edit gallery content. Sites that do not run the plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00063,"input_tokens":3328,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114710':11A,14A '-2026':10A,13A '1.3.7':8A,94C 'add':51B 'affect':88C 'allow':84C 'attack':47B 'browser':61B 'chill':30B,77C 'content':52B 'cross':41B,71C 'cross-sit':40B,70C 'cve':9A,12A 'galleri':2A,24B,78C,83C,89C 'generat':36B,69C 'grid':82C 'host':18B 'improp':62C 'input':34B,65C 'issu':87C 'n/a':92C 'neutral':33B,63C 'packag':15B 'page':37B,68C 'photoblock':3A,25B,79C,81C,90C 'photoblocks-grid-galleri':80C 'plant':54B 'plugin':4A,22B,27B 'possibl':45B 'right':49B 'run':57B 'script':43B,55B,73C 'self':17B 'self-host':16B 'site':42B,72C 'store':5A,39B,85C 'visitor':60B 'vulner':74C 'web':67C 'wordpress':1A,19B,21B,26B 'wordpress-plugin':20B 'wp':29B,76C 'xss':6A 'xss.this':86C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running Gallery PhotoBlocks version 1.3.7 or older. The flaw is stored XSS, so the risk is highest where users other than administrators can submit or edit gallery content. Sites that do not run the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T17:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114710","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114710","severity":null,"published_at":"2026-10-26T17:17:15+00:00","modified_at":"2026-10-26T17:17:15+00:00","first_seen_at":"2026-10-26T17:31:21+00:00","fetched_at":"2026-10-26T17:31:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}