CVE-2026-84781: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WP Chill Gallery PhotoBlocks

CVE-2026-84781 is a CWE-79 cross-site scripting vulnerability in the WP Chill Gallery PhotoBlocks plugin affecting versions up to and including 1.3.4. It allows contributor-level users to inject malicious scripts due to improper input neutralization during web page generation. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity with network attack vector, low attack complexity, required privileges at contributor level, user interaction required, and impacts on confidentiality, integrity, and availability. No patch or official remediation guidance has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker with contributor privileges to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level user privileges and monitor for suspicious activity related to script injection attempts.