SmugMug Embed WordPress plugin: Unauthenticated stored XSS in settings screen
Summary
The SmugMug Embed WordPress plugin through version 3.13 does not check authorisation or CSRF tokens on an AJAX action that stores gallery data, and does not sanitise or escape that data on output. An unauthenticated attacker can store arbitrary web script that runs when an administrator opens the plugin's settings screen. Successful exploitation could allow session hijacking, account takeover or further compromise of the WordPress site, but it requires an administrator to view the affected screen.
Affected
- SmugMug Embed WordPress plugin (slug smugmug-embed), versions through and including 3.13
- Vendor: Unknown (a third-party directory lists the developer as twicklund; unverified)
Fixed in
- Conflicting information. OpenCVE states upgrade to version 3.14 or later; WPScan lists No known fix. Unverified.
Workaround
- Unknown. No vendor or WPScan workaround found.
Exploitation
- No evidence of exploitation in the wild.
- CISA SSVC: exploitation none, automatable no.
- Not in the KEV catalogue. EPSS about 0.12%.
- Public proof of concept: unclear; not verified.
Our recommendation
- Inventory all WordPress sites with the SmugMug Embed plugin and note the installed version.
- If the plugin is not needed, deactivate and remove it.
- Treat all versions up to 3.13 as vulnerable until a fixed version is confirmed on the wordpress.org plugin page.
- Restrict access to wp-admin (IP allowlisting, VPN or SSO) to reduce the risk of an administrator viewing a malicious payload.
- Review the plugin's stored data and settings for unexpected entries and check for signs of compromise.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability entry wpscan.com
- OpenCVE CVE-2026-88826 app.opencve.io
- Vulners NVD CVE-2026-88826 vulners.com
- GitHub CVE tracker issue (EPSS) github.com
- WordPress.org SmugMug Embed documentation wordpress.org
- Plugin description (Common Ninja directory) discover.commoninja.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:36.
Original description (NVD)
The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthenticated users to store arbitrary web scripts that execute when an administrator views the SmugMug Embed WordPress plugin through 3.13's settings screen.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.