What is GHSA-pgv8-gvc5-v6h7?

GHSA-pgv8-gvc5-v6h7 is a security advisory published by GitHub Security Advisories with High severity. The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an...

Which CVE IDs does GHSA-pgv8-gvc5-v6h7 cover?

GHSA-pgv8-gvc5-v6h7 covers the following CVE IDs: CVE-2026-88826. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pgv8-gvc5-v6h7?

GHSA-pgv8-gvc5-v6h7 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-pgv8-gvc5-v6h7HighCVSS 8.8

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an...

Vendor

GitHub Security Advisories

Published

October 11, 2026

Last Modified

October 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-88826 →

📋 Description

The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-88826
https://wpscan.com/vulnerability/6e8925b5-85a1-48e3-b744-df1c6fa24ed4
https://github.com/advisories/GHSA-pgv8-gvc5-v6h7