Gallery Blocks with Lightbox < 2.2.1- Authenticated Stored Cross-Site Scripting
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A stored cross-site scripting vulnerability has been discovered in : Simply Gallery Blocks with Lightbox (Version – 2.2.0 & below). The vulnerability exists in the Lightbox functionality where a user with low privileges is allowed to execute arbitrary script code within the context of the application. This vulnerability is due to insufficient validation of image parameters in meta data.
Why it matters now
EPSS 0.00618 49th percentileScored 2026-11-07
Fix Fixed Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery (Unknown): 2.2.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery | 2.2.1 to before 2.2.1 | 2.2.1 | Patch available | CNA |
- Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery VendorUnknown Affected 2.2.1 to before 2.2.1 Fixed in 2.2.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:simplygallery:simply_gallery_blocks_with_lightbox:*:*:*:*:*:wordpress:*:* | before 2.2.1 | Vulnerable | Simplygallery |
- cpe:2.3:a:simplygallery:simply_gallery_blocks_with_lightbox:*:*:*:*:*:wordpress:*:* Versions before 2.2.1 Vulnerable ·Simplygallery
Remediation
- Fix · CNA Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery (Unknown) Fixed in 2.2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24667
- 2026-10-03 Alias added: GHSA-7x7j-cf43-24q8
References
More Simplygallery Simply Gallery Blocks With Lightbox vulnerabilities
- TI-2023-00418 Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options Update CVSS 3.1HIGH 8.1
Sources
- CVE-2021-24667 · CVE Program
- CVE-2021-24667 · NVD
- FIRST EPSS
- GHSA-7x7j-cf43-24q8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences