CVE-2026-88826

The SmugMug Embed WordPress plugin, in versions up to and including 3.13 , is vulnerable to an unauthenticated stored XSS (Cross-Site Scripting). The flaw exists because an AJAX action used to store gallery data lacks proper authorization and CSRF checks , and the data is not correctly sanitized ...