Cross-site Scripting Vulnerability in NotFound Gallery by WordPress
CVE-2025-26778

5.9MEDIUM

Key Information:

Vendor
Notfound
Status
Gallery
Vendor
CVE Published:
17 February 2025

Summary

The NotFound Gallery plugin for WordPress contains a vulnerability that allows attackers to exploit improper input handling during web page generation, enabling Stored Cross-site Scripting (XSS). This flaw could let malicious scripts be executed within the context of the user's browser, ultimately compromising user data and site integrity. Products affected range up to version 2.2.1.

Affected Version(s)

Gallery <= 2.2.1

References

https://patchstack.com/database/wordpress/plugin/gallery/...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Caesar Evan Santoso (Patchstack Alliance)
.