This vulnerability (CVE-2026-24628) is an improper input neutralization issue (CWE-79) in the Photo Gallery by Supsystic plugin, affecting versions up to 1.16.3. It enables an authenticated administrator to inject malicious scripts via web page generation processes, resulting in reflected or stored cross-site scripting. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary scripts in the context of the affected application, potentially leading to partial disclosure of sensitive information, modification of data, and disruption of service. The attack requires high privileges and user interaction, limiting the scope but still posing a risk to the integrity and confidentiality of the application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and apply standard web application security controls to limit the impact of potential XSS attacks.