CVE-2026-88826: CWE-79 Cross-Site Scripting (XSS) in SmugMug Embed

The SmugMug Embed WordPress plugin versions up to and including 3.13 contain a vulnerability where an AJAX action that stores gallery data does not implement authorization or CSRF checks. Additionally, the plugin does not sanitize or escape the stored data before rendering it in the settings interface. As a result, unauthenticated attackers can inject malicious scripts that execute in the context of an administrator's browser when they view the plugin settings, leading to potential cross-site scripting attacks.

An unauthenticated attacker can store arbitrary scripts that execute in the administrator's browser when viewing the plugin settings. This could lead to session hijacking, privilege escalation, or other malicious actions performed with administrator privileges. However, there is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the WordPress admin area and avoid visiting the SmugMug Embed plugin settings page by untrusted users. Monitor vendor channels for updates and apply official patches once released.