Cross-site Scripting Vulnerability in bPlugins Image Gallery by bPlugins
CVE-2026-115613

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Image Gallery Block – Create And Display Photo Gallery/photo Album.
Vendor
CVE Published:
26 October 2026

What is CVE-2026-115613?

The bPlugins Image Gallery block, which enables the creation and display of photo galleries and albums, has a vulnerability due to improper neutralization of input during web page generation. This issue could allow attackers to execute malicious scripts in the context of a user's browser, leading to Stored Cross-site Scripting (XSS). Affected versions include the plugin from its initial release up to version 2.4.1.

Affected Version(s)

Image Gallery block – Create and display photo gallery/photo album. 0 <= 2.4.1

References

https://patchstack.com/database/wordpress/plugin/3d-image...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ihsan Saddan | Patchstack Bug Bounty Program
.