CVE-2026-88826

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator...

EUVD-2026-96774

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator...

CVE-2026-88826 SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator...

CVE-2026-88826

The SmugMug Embed WordPress plugin, in versions up to and including 3.13 , is vulnerable to an unauthenticated stored XSS (Cross-Site Scripting). The flaw exists because an AJAX action used to store gallery data lacks proper authorization and CSRF checks , and the data is not correctly sanitized ...

PT-2026-110048

Name of the Vulnerable Software and Affected Versions SmugMug Embed versions prior to 3.14 Description An issue exists where an AJAX action used to store gallery data lacks authorization and Cross-Site Request Forgery CSRF checks. Additionally, the plugin fails to sanitize or escape this data...

CVE-2026-88826: Improper Neutralization of Input During Web Page Generation

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator...

CVE-2026-97290

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

CVE-2026-97290 WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

EUVD-2026-90217

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

CVE-2026-97290

The Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin, in versions

CVE-2026-97290 WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions = 3.36...

PT-2026-103506

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

CVE-2026-97290: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

CVE-2026-66434

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-66434

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

EUVD-2026-49243

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

CVE-2026-66434

Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin ≤ 3.33 is affected by a Cross Site Scripting (XSS) vulnerability. CVSSv3.1 base score 6.5 (MEDIUM) with network access, low privileges, user interaction required. Root cause and remediation details are not provided in the d...

CVE-2026-66434 WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.33 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions = 3.33...