Cross-Site Scripting Vulnerability in Gallery PhotoBlocks Plugin by WordPress
CVE-2026-107323

Currently unrated

Key Information:

Vendor

WordPress
Status
Gallery Photoblocks
Vendor
CVE Published:
10 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-107323?

The Gallery PhotoBlocks plugin for WordPress prior to version 1.3.6 presents a security vulnerability where it fails to properly sanitize and escape a gallery setting. This oversight allows users with Contributor-level access and higher to inject JavaScript code that can be executed in the browsers of visitors viewing the affected pages, potentially compromising the security of the site. This vulnerability highlights the need for vigilant coding practices to prevent potential exploits that could affect both ordinary users and administrators.

Affected Version(s)

Gallery PhotoBlocks 1.3.5 < 1.3.6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-107323 - Proof of Concept

References

https://wpscan.com/vulnerability/19a8c2db-fb31-4203-83d6-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andy Urlep
WPScan
.