CVE-2026-65447

CVE-2026-65447 concerns an unauthenticated cross-site scripting (XSS) vulnerability in the WordPress plugin Contest Gallery , affecting versions up to 30.0.6 . The root cause is an XSS flaw that can be triggered without authentication, with CVSS v3.1 metrics indicating a base score of 7.1 (HIGH),...

CVE-2026-66396

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...

CVE-2026-66396 SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...

CVE-2026-66396

SiYuan before v3.7.2 has a stored XSS in the Gallery/Kanban cover rendering due to failing to escape the title-img Individual Attribute List value. The unescaped style attribute interpolation allows onload handlers injected by an editor, enabling arbitrary code execution in the Electron renderer ...

CVE-2026-66396 SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...

CVE-2026-66396

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...

CVE-2026-66396 SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...

EUVD-2026-49329

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...

CVE-2026-66434

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-66448

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

EUVD-2026-49248

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

CVE-2026-66448

WordPress Gallery PhotoBlocks plugin ≤ 1.3.3 has a Cross Site Scripting (XSS) vulnerability in contributor contexts. Affected product: Gallery PhotoBlocks plugin for WordPress (versions up to 1.3.3). Root cause details are not provided in the documents. CVSSv3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:...

CVE-2026-66448 WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

CVE-2026-66448

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

EUVD-2026-49243

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-66434

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-66434

Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin ≤ 3.33 is affected by a Cross Site Scripting (XSS) vulnerability. CVSSv3.1 base score 6.5 (MEDIUM) with network access, low privileges, user interaction required. Root cause and remediation details are not provided in the d...

CVE-2026-66434 WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-12982

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...

CVE-2026-12982

The Document Gallery WordPress plugin (before 5.1.1) is affected by a Reflected XSS in an unauthenticated AJAX action (dg_generate_gallery) caused by improper sanitisation/escaping of user input. Impact is XSS for unauthenticated users; remediation is to update to 5.1.1 or later (as stated in CVE...