CVE-2021-47951CWE-79

WordPress Picture Gallery 1.4.2 Stored XSS via Edit Content URL

Medium · published May 10, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
7.9
In the wild
Unconfirmed
What it is

WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Edit Content URL field in the Access Control settings. Attackers can enter JavaScript payloads in the plugin options that are stored in the database and executed when the functionality is triggered, enabling session hijacking or credential theft.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00187 · 7.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-10T12:52Z
EPSS history
Timeline
  • 10 MAY 12:52Z
    WordPress Picture Gallery 1.4.2 Stored XSS via Edit Content URL
    cvelistv5