CVE-2026-24628

WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability

Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.

We have discovered 8,030 live websites that are affected by CVE-2026-24628.

Run a Free Instant Scan



Affected Software

Product  Photo Gallery by Supsystic
Category Wordpress Plugins
Vulnerable Domains8,030 live websites (100% of Photo Gallery by Supsystic install base)
Vulnerable Versions
  • from 0 through 1.16.3
Vulnerable Versions Count121 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Jul 23, 2026
  • Updated - Jul 23, 2026

Credits

  • Mrreee | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-24628
United States739 websites


Germany1,721 websites
France880 websites
Italy535 websites
Poland485 websites
Netherlands472 websites
Russia360 websites
Czech Republic245 websites
Switzerland228 websites
Hungary217 websites

Website Distribution by TLD

Number of websites using CVE-2026-24628
.com1,889 websites
.de1,362 websites
.fr455 websites
.nl446 websites
.pl383 websites
.it365 websites
.ru285 websites
.cz204 websites
.com.br197 websites
.org195 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-24628

Top websites that are affected by CVE-2026-24628. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.***************.com South Africa***,***
*************.de Germany***,***
**********************.com Germany***,***
************.com United States***,***
***.*********.com United States***,***
****.net Germany***,***
*********.com United States***,***
***************.de Germany***,***
****.org France***,***
**********.org France***,***
See full domain list

FAQ

CVE-2026-24628 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Photo Gallery by Supsystic
A total of 8,030 websites have been identified as vulnerable to CVE-2026-24628, based on global website indexing conducted by WebTechSurvey.
The Photo Gallery by Supsystic is affected by the CVE-2026-24628 vulnerability.
Photo Gallery by Supsystic versions up to and including 1.16.3 are vulnerable to CVE-2026-24628.