This vulnerability (CVE-2026-65519) in gt3themes Photo Gallery is an improper neutralization of input during web page generation (CWE-79), specifically an XSS flaw. It affects Photo Gallery versions up to and including 2.7.7.29. The issue allows an author-level user to inject malicious scripts that could impact confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change. No patch or official remediation level has been provided by the vendor as of the published date.

Successful exploitation could allow an authenticated author to execute arbitrary scripts in the context of the affected web application, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability requires author-level privileges and user interaction, limiting the attack scope. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level privileges to trusted users only and consider additional input validation or web application firewall rules to mitigate potential exploitation.