The WP Chill Gallery PhotoBlocks plugin up to version 1.3.2 suffers from a DOM-based cross-site scripting vulnerability caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability. The vulnerability is published and tracked as CVE-2026-24389 but no patch or vendor advisory is currently available.

Successful exploitation of this vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data due to execution of attacker-controlled scripts in the victim's browser context. This can facilitate actions such as session hijacking, defacement, or other malicious activities depending on the context in which the plugin is used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected Gallery PhotoBlocks plugin version 1.3.2 or earlier. Avoid clicking on untrusted links that may trigger the vulnerability and monitor for updates from WP Chill regarding patches or mitigations.