WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Edit C…

Code

The project this record applies to. Exploit listings stay in References.

• Plugin source · wordpress.org

Timeline

Detection, updates, and resolution for this record.

1. May 10, 2026 · NIST NVD

   Detected

   WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Edit Content URL field in the Access Control settings. Attackers can enter JavaScript payloads in the plugin options that are stored in the database and executed when the functionality is triggered, enabling session hijacking or credential

2. Jul 25, 2026 · NIST NVD

   Updated

   WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Edit Content URL field in the Access Control settings. Attackers can enter JavaScript payloads in the plugin options that are stored in the database and executed when the functionality is triggered, enabling session hijacking or credential

Sources

• CVE.orgVulnerability recordCVE-2021-47951

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2021-47951

  WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Edit Content URL field in the Access Control settings. Attackers can enter JavaScript payloads in the plugin options th

  nvd.nist.gov

References

• Reference · wordpress.org
• Reference · exploit-db.com
• Reference · vulncheck.com