CVE-2026-88826: high-severity vulnerability in SmugMug Embed
SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.8epss 0.2%
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · SmugMug Embedpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/6e8925b5-85a1-48e3-b744-df1c6fa24ed4/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.