Atomic Edge analysis of CVE-2026-24389:
The Gallery PhotoBlocks WordPress plugin, versions up to and including 1.3.2, contains an authenticated stored cross-site scripting (XSS) vulnerability. The flaw allows users with contributor-level permissions or higher to inject arbitrary JavaScript into gallery configurations. This script executes in the context of any user viewing the affected gallery on the front end, representing a medium-severity risk.
Root Cause:
The vulnerability stems from insufficient input sanitization and output escaping in three specific areas. The `class-photoblock.php` file’s `get_alt()` method (lines 130-138) returns the `image->alt` property and the `get_title()` method’s result without escaping. The `class-photoblocks-settings.php` file’s `setup_fields()` method (lines 1047-1089) unconditionally registers three custom event fields (`custom_event_before`, `custom_event_refresh`, `custom_event_after`) as textareas, accepting raw JavaScript. The `photoblocks-public-display.php` file (line 393) outputs the result of the `fonts_to_load()` function directly without escaping the URL.
Exploitation:
An authenticated attacker with contributor privileges can exploit this by creating or editing a gallery block. They inject malicious JavaScript payloads into the gallery’s image alt/title fields or into the three custom event fields accessible via the plugin’s settings interface. The payloads are stored in the WordPress database. When a victim visits a page containing the malicious gallery, the unsanitized JavaScript executes in their browser.
Patch Analysis:
The patch in version 1.3.3 introduces multiple layered defenses. In `class-photoblock.php`, the `get_alt()` method now wraps both the `image->alt` property and the `get_title()` return value in `esc_attr()`. In `class-photoblocks-settings.php`, the registration of the three custom event fields is now wrapped in a `current_user_can(‘unfiltered_html’)` check, hiding them from users without that capability. The `setup_fields()` method is also changed from private to public and hooked to `admin_init`. In `class-photoblocks-admin.php`, a check strips the custom event fields from the update data array if the user lacks the `unfiltered_html` capability. Finally, `photoblocks-public-display.php` now escapes the output of `fonts_to_load()` with `esc_url()`.
Impact:
Successful exploitation leads to stored XSS. An attacker can perform actions within the victim’s WordPress session, such as creating new administrative users, modifying posts, injecting backdoors, or redirecting users to malicious sites. The attacker must have at least contributor-level access, but this is a low barrier on many sites. The vulnerability directly compromises site integrity and user security.
