{"id":"CVE-2026-52709","kind":"vulnerability","aliases":["CVE-2026-52709"],"related":[],"title":"Video Gallery Block WordPress plugin: stored XSS through version 1.6.0","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.","summary":"The bPlugins Video Gallery Block plugin for WordPress has a stored cross-site scripting flaw in versions up to and including 1.6.0. An attacker who can save content can plant script that runs in the browser of other visitors or editors.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","video-gallery-block","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version of `video-gallery-block` in the WordPress admin plugin list.","fix":null,"status":"open","published_at":"2026-10-29T13:17:13+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","triaged_at":"2026-10-29T13:25:38+00:00","updated_at":"2026-10-29T13:25:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T13:25:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Video Gallery Block WordPress plugin: stored XSS through version 1.6.0","impact":"medium","summary":"The bPlugins Video Gallery Block plugin for WordPress has a stored cross-site scripting flaw in versions up to and including 1.6.0. An attacker who can save content can plant script that runs in the browser of other visitors or editors.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","video-gallery-block"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in other visitors' browsers on the site","analyst_note":"Confirm the fixed version and required privilege level from the bPlugins advisory or the WordPress plugin changelog; NVD text gives only the affected range.","how_to_check":"- Check the installed plugin version of `video-gallery-block` in the WordPress admin plugin list.\n- Unknown whether the sources list other checks.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Video Gallery Block plugin at version 1.6.0 or older are in scope, per the NVD description (affected range listed as n/a through 1.6.0). Sites without the plugin are not affected. The sources do not say which user roles can inject the stored script, so unknown whether an account is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4125,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-52709':13A,16A '1.6.0':10A,45B,98C 'affect':91C 'allow':87C 'attack':47B 'block':3A,21B,27B,82C,86C,94C 'bplugin':24B,79C 'browser':59B 'content':51B 'cross':35B,74C 'cross-sit':34B,73C 'cve':11A,14A 'editor':64B 'flaw':38B 'galleri':2A,20B,26B,81C,85C,93C 'generat':72C 'improp':65C 'includ':44B 'input':68C 'issu':90C 'n/a':96C 'neutral':66C 'packag':17B 'page':71C 'plant':53B 'plugin':5A,28B 'run':56B 'save':50B 'script':37B,54B,76C 'site':36B,75C 'store':6A,33B,88C 'version':9A,40B 'video':1A,19B,25B,80C,84C,92C 'video-gallery-block':18B,83C 'visitor':62B 'vulner':77C 'web':70C 'wordpress':4A,22B,30B 'xss':7A 'xss.this':89C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Video Gallery Block plugin at version 1.6.0 or older are in scope, per the NVD description (affected range listed as n/a through 1.6.0). Sites without the plugin are not affected. The sources do not say which user roles can inject the stored script, so unknown whether an account is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-52709","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52709","severity":null,"published_at":"2026-10-29T13:17:13+00:00","modified_at":"2026-10-29T13:17:13+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","fetched_at":"2026-10-29T13:25:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}