Cross Site Scripting Vulnerability in Photo Gallery by Supsystic
CVE-2026-24628

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Photo Gallery By Supsystic
Vendor
CVE Published:
23 July 2026

What is CVE-2026-24628?

A Cross Site Scripting (XSS) vulnerability has been identified in the Photo Gallery by Supsystic plugin for WordPress, affecting versions up to 1.16.3. This security flaw could allow an attacker to inject malicious scripts into the web pages that are viewed by users with administrative privileges. When triggered, these scripts may execute in the context of the user's browser, potentially leading to unauthorized access or data exposure.

Affected Version(s)

Photo Gallery by Supsystic <= 1.16.3

References

https://patchstack.com/database/wordpress/plugin/gallery-...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mrreee | Patchstack Bug Bounty Program
.