CVE-2013-3261: Photogallerycreator Flash-Album-Gallery

Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action.

Affected products

• Photogallerycreator Flash-Album-Gallery: up to and including 2.71; version 0.29 only; version 0.32 only; version 0.33 only; version 0.34 only; version 0.35 only; …

Published 2013-06-01. Last modified 2026-06-16.