CVE-2026-97290 in Photonic Gallery & Lightbox for Flickr
Summary
by MITRE • 09/30/2026
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an unauthenticated cross-site scripting flaw within the Photonic Gallery and Lightbox plugin for WordPress affects all installations running version 3.36 or earlier. This security issue stems from insufficient input validation and sanitization mechanisms when processing user-supplied data that is subsequently rendered in web pages without proper encoding. In a typical attack scenario, an adversary can inject malicious JavaScript code into fields such as image titles, captions, or metadata inputs within the plugin's interface. Because this execution occurs prior to any authentication requirement, the vulnerability allows for remote exploitation by unauthenticated users who do not need valid credentials to initiate the attack vector against site administrators or visitors interacting with the compromised content.
From a technical perspective, the core deficiency lies in the failure to properly escape special characters within dynamic HTML output contexts. When the plugin generates gallery displays or lightbox overlays, it incorporates user-controlled data directly into the DOM structure without applying adequate context-specific encoding rules defined by industry standards such as CWE-79. This oversight enables script injection that persists on the server side if stored in database fields associated with media items, leading to a Stored XSS classification under Common Weakness Enumeration guidelines. The injected payload executes automatically when other users view the affected gallery or lightbox component, leveraging the browser's trust in the domain of the vulnerable website to run arbitrary code within the security context of that origin.
The operational impact of this vulnerability is significant due to its unauthenticated nature and potential for persistence. Attackers can exploit this flaw to steal session cookies, hijack administrative accounts by performing actions on behalf of authenticated users, or redirect victims to phishing sites designed to harvest credentials. Furthermore, persistent XSS attacks embedded in media metadata mean that every subsequent visitor to the gallery becomes a potential victim without any additional interaction required beyond page load. This capability undermines the integrity and confidentiality guarantees provided by web applications, potentially leading to widespread compromise if an administrator views maliciously crafted content while logged into their dashboard or other sensitive areas of the site.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators should upgrade the Photonic Gallery & Lightbox plugin to version 3.37 or later where these input validation issues have been addressed by implementing robust sanitization routines and output encoding practices aligned with OWASP guidelines. In environments where upgrading is not immediately feasible, temporary workarounds may include restricting access to media management interfaces via IP whitelisting or disabling specific features that expose vulnerable endpoints until patches are applied. Continuous monitoring for anomalous script execution patterns in server logs can also aid in detecting active exploitation attempts associated with this weakness categorized under MITRE ATT&CK technique T1059 as Command and Scripting Interpreter within the Execution tactic.