Live › vulnerability › CVE-2026-115613
Go to dashboardThe bPlugins Image Gallery block for WordPress, versions through 2.4.1, fails to neutralize input when generating pages, which allows stored cross-site scripting. An attacker who can store content in a gallery can run JavaScript in the browser of anyone who views the page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 10:29 UTC. All times on this page are UTC.
Sites running the bPlugins Image Gallery block plugin at version 2.4.1 or earlier on WordPress. Exposure depends on whether untrusted users can add or edit gallery content; sites where only trusted editors manage galleries carry less risk. Sites without the plugin are not affected.
No product ranges from the sources yet.
Image Gallery block – Create and display photo gallery/photo album plugin (slug unknown from sources) is installed in WordPress admin under Plugins2.4.1 or earlier2.4.1 (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through 2.4.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-115613")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.