Live › vulnerability › CVE-2026-116408
Go to dashboardThe Gallery PhotoBlocks WordPress plugin by WP Chill does not neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can save content on the site can run script in the browsers of visitors or administrators who view it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Sites running the Gallery PhotoBlocks plugin at version 1.3.7 or earlier are exposed. Exposure depends on whether users with low privileges can save content that is later rendered to other visitors or administrators. Sites that do not have the plugin installed can skip it.
No product ranges from the sources yet.
photoblocks-grid-gallery in the WordPress admin under Plugins, or in wp-content/plugins/photoblocks-grid-gallery/1.3.7 or earlierphotoblocks-grid-gallery to a version later than 1.3.7Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-116408")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.