PT-2026-1635

CVE-2025-14453

Published

2026-01-06

Updated

2026-01-07

Description by

CVSS 3.1

6.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions My Album Gallery plugin for WordPress versions prior to 1.0.5

Description The My Album Gallery plugin for WordPress is susceptible to Stored Cross-Site Scripting through the style css shortcode attribute. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

Recommendations Update the My Album Gallery plugin to version 1.0.5 or later.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration