This vulnerability (CVE-2026-66434) is a CWE-79 Cross-site Scripting (XSS) issue in the Photonic Gallery & Lightbox plugin for Flickr, SmugMug & Others by Sayontan Sinha. It affects versions up to and including 3.33. The flaw arises from improper neutralization of input during web page generation, which can be exploited by users with contributor privileges to execute arbitrary scripts in the context of the affected web application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and partial impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with contributor-level access to execute arbitrary scripts in the context of the affected application, potentially leading to partial disclosure of information, modification of data, and disruption of availability. The impact is limited by the requirement for privileges and user interaction, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit contributor privileges to trusted users and consider additional input validation or sanitization controls where possible.