CVE-2026-88826 — SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums

CVE-2026-88826

SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums PUBLISHED

Description (CNA)

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.

Affected (CNA)

Vendor / product	Versions
Unknown / SmugMug Embed	affected 0 through 3.13

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/6e8925b5-85a1-48e3-b744-df1c6fa24ed4/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.