{"id":"CVE-2026-116408","kind":"vulnerability","aliases":["CVE-2026-116408"],"related":[],"title":"WordPress Gallery PhotoBlocks plugin: stored XSS through version 1.3.7","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.","summary":"The Gallery PhotoBlocks WordPress plugin by WP Chill does not neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can save content on the site can run script in the browsers of visitors or administrators who view it.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","photoblocks-grid-gallery","wordpress","wp-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the plugin `photoblocks-grid-gallery` in the WordPress admin under Plugins, or in `wp-content/plugins/photoblocks-grid-gallery/`\n- Look for a version of `1.3.7` or earlier\n- unknown whether the sources list a specific vulnerable input field","fix":"- Update the plugin `photoblocks-grid-gallery` to a version later than `1.3.7`\n- unknown whether a patched version number is published in the sources","status":"open","published_at":"2026-10-26T18:17:44+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","triaged_at":"2026-10-26T18:33:54+00:00","updated_at":"2026-10-26T18:33:54+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T18:33:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the plugin `photoblocks-grid-gallery` to a version later than `1.3.7`\n- unknown whether a patched version number is published in the sources","reach":"internet","title":"WordPress Gallery PhotoBlocks plugin: stored XSS through version 1.3.7","impact":"medium","summary":"The Gallery PhotoBlocks WordPress plugin by WP Chill does not neutralize input when generating pages, allowing stored cross-site scripting. An attacker who can save content on the site can run script in the browsers of visitors or administrators who view it.","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","photoblocks-grid-gallery"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in victims' browsers on the site","analyst_note":"Confirm the patched version and the privilege level needed to inject the payload from the NVD entry or the plugin changelog.","how_to_check":"- Check the installed version of the plugin `photoblocks-grid-gallery` in the WordPress admin under Plugins, or in `wp-content/plugins/photoblocks-grid-gallery/`\n- Look for a version of `1.3.7` or earlier\n- unknown whether the sources list a specific vulnerable input field","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Gallery PhotoBlocks plugin at version 1.3.7 or earlier are exposed. Exposure depends on whether users with low privileges can save content that is later rendered to other visitors or administrators. Sites that do not have the plugin installed can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000641,"input_tokens":3328,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116408':12A,15A '-2026':11A,14A '1.3.7':9A,99C 'administr':64B 'affect':93C 'allow':40B,89C 'attack':47B 'browser':60B 'chill':32B,82C 'content':51B 'cross':43B,76C 'cross-sit':42B,75C 'cve':10A,13A 'galleri':2A,20B,26B,83C,88C,94C 'generat':38B,74C 'grid':19B,87C 'improp':67C 'input':36B,70C 'issu':92C 'n/a':97C 'neutral':35B,68C 'packag':16B 'page':39B,73C 'photoblock':3A,18B,27B,84C,86C,95C 'photoblocks-grid-galleri':17B,85C 'plugin':4A,24B,29B 'run':56B 'save':50B 'script':45B,57B,78C 'site':44B,54B,77C 'store':5A,41B,90C 'version':8A 'view':66B 'visitor':62B 'vulner':79C 'web':72C 'wordpress':1A,21B,28B 'wp':23B,31B,81C 'wp-plugin':22B 'xss':6A 'xss.this':91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gallery PhotoBlocks plugin at version 1.3.7 or earlier are exposed. Exposure depends on whether users with low privileges can save content that is later rendered to other visitors or administrators. Sites that do not have the plugin installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116408","severity":null,"published_at":"2026-10-26T18:17:44+00:00","modified_at":"2026-10-26T18:17:44+00:00","first_seen_at":"2026-10-26T18:31:44+00:00","fetched_at":"2026-10-26T18:31:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}