PT-2026-99535 · WordPress · Event Gallery
CVE-2026-97165
·
Published
2026-09-27
·
Updated
2026-09-30
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Event Gallery versions prior to 6.5.0
Description
A reflected Cross-Site Scripting (XSS) and open redirect issue exists. The
return parameter is base64-decoded and written to the Back link without proper validation.Recommendations
Update to version 6.5.0 or later.
Avoid using the
return parameter in the affected component until the update is applied.Fix
XSS
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Event Gallery