Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-88826: SmugMug Embed plugin lets attackers run scripts in admin
CVE-2026-88826 · published 7 days ago
Summary
The SmugMug Embed WordPress plugin (versions up to 3.13) lets anyone without logging in store malicious code that is later shown on the plugin’s settings page. When an administrator opens that page, the hidden code runs in their browser, potentially stealing data or changing settings. Update the plugin to a newer version or remove it until a fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | smugmug embed | <= 3.13 |
Original advisory text
SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-79Cross-site Scripting (XSS)
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published11 Oct 2026
Updated16 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta