Is CVE-2026-119484 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119484 being exploited in the wild.

How severe is CVE-2026-119484?

Medium severity, with a CVSS score of 6.3, published 7 November 2026.

Which products and versions are affected?

Supsystic Photo Gallery by Supsystic through 1.21.6.

Is there a fix for CVE-2026-119484?

Yes: fixed in 1.21.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119484 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119484?

Check whether you run Supsystic Photo Gallery by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119484: Supsystic Photo Gallery CSRF in plugin settings

CVE-2026-119484 · Severity: medium · CVSS 6.3 · Published 2026-11-07

Photo Gallery by Supsystic is a WordPress plugin that allows website administrators to create and manage image galleries. A cross-site request forgery (CSRF) vulnerability in versions through 1.21.6 allows an attacker to trick a logged-in administrator into unwittingly performing actions in the plugin—such as modifying gallery settings or configurations—by visiting a malicious website. This could result in unauthorized changes to the site's gallery content or settings.

Vendors: Supsystic.

Quick answers

Is CVE-2026-119484 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119484 being exploited in the wild.
How severe is CVE-2026-119484?: Medium severity, with a CVSS score of 6.3, published 7 November 2026.
Which products and versions are affected?: Supsystic Photo Gallery by Supsystic through 1.21.6.
Is there a fix for CVE-2026-119484?: Yes: fixed in 1.21.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119484 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119484?: Check whether you run Supsystic Photo Gallery by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.21.7

Technical details

This is a CSRF vulnerability affecting the Photo Gallery by Supsystic WordPress plugin through version 1.21.6. The vulnerability requires user interaction (a privileged user must click a malicious link or visit a crafted page) and can only be exploited against authenticated administrators. An attacker cannot directly modify plugin settings but can induce an admin to perform unintended actions through forged requests.

Affected products

Supsystic Photo Gallery by Supsystic through 1.21.6

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.