Cross-site Scripting Vulnerability in NotFound Gallery by WordPress
CVE-2025-26778

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Gallery
Vendor
CVE Published:
17 February 2025

What is CVE-2025-26778?

The NotFound Gallery plugin for WordPress contains a vulnerability that allows attackers to exploit improper input handling during web page generation, enabling Stored Cross-site Scripting (XSS). This flaw could let malicious scripts be executed within the context of the user's browser, ultimately compromising user data and site integrity. Products affected range up to version 2.2.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Gallery <= 2.2.1

References

https://patchstack.com/database/wordpress/plugin/gallery/...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Caesar Evan Santoso (Patchstack Alliance)
JSON
.