Is CVE-2026-24628 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24628 being exploited in the wild.

How severe is CVE-2026-24628?

Medium severity, with a CVSS score of 5.9, published 23 July 2026.

Which products and versions are affected?

Supsystic Photo Gallery by Supsystic <= 1.16.3.

Is there a fix for CVE-2026-24628?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-24628 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-24628?

Check whether you run Supsystic Photo Gallery by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24628: Supsystic Photo Gallery Administrator XSS

Q: Is there a fix for CVE-2026-24628?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-24628 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-24628?

Check whether you run Supsystic Photo Gallery by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24628 · Severity: medium · CVSS 5.9 · Published 2026-07-23

Photo Gallery by Supsystic is a WordPress plugin used to create and manage image galleries. A security vulnerability allows an attacker with administrative access to inject malicious scripts into the website's management interface. If another administrator views the affected area, the script could execute, potentially leading to unauthorized actions or the redirection of site visitors to malicious websites.

Vendors: Supsystic.

Quick answers

Is CVE-2026-24628 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24628 being exploited in the wild.
How severe is CVE-2026-24628?: Medium severity, with a CVSS score of 5.9, published 23 July 2026.
Which products and versions are affected?: Supsystic Photo Gallery by Supsystic <= 1.16.3.
Is there a fix for CVE-2026-24628?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-24628 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-24628?: Check whether you run Supsystic Photo Gallery by Supsystic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the Photo Gallery by Supsystic plugin for WordPress in versions up to and including 1.16.3. The flaw is due to improper neutralization of input during web page generation (CWE-79). An attacker with high privileges (Administrator) can inject malicious JavaScript payloads that execute in the context of another user's browser when they interact with the affected component. This requires user interaction from a victim. Successful exploitation could allow for session hijacking or unauthorized administrative actions. As of the advisory date, no official patch has been released.

Affected products

Supsystic Photo Gallery by Supsystic <= 1.16.3

Timeline

2025-12-11: disclosed: Vulnerability reported by researcher Mrreee
2026-07-23: advisory: NVD and Patchstack published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.