CVE-2026-119484 · Package
NO FIX YET · SEE WHAT TO DO
Photo Gallery by Supsystic, a WordPress plugin, has a cross-site request forgery flaw affecting versions through 1.21.6. An attacker can trick a logged-in user's browser into sending requests the plugin accepts without checking intent.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Photo Gallery by Supsystic WordPress plugin at version 1.21.6 or earlier are in the range given. The exploit needs a logged-in privileged user to visit a malicious page, so sites with no logged-in administrators active are less exposed. The sources do not say which specific actions are affected.
Not affected if plugin-not-installed, version-above-1.21.6
Who cares photo-gallery-by-supsystic, wordpress
1.21.6; versions at or below that are in the range the sources give1.21.6Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.