Mixed Media Gallery Blocks <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via Global Presets
- ID
- WPSEC-2026-0278
- Plugin
- SimpLy Gallery (simply-gallery-block)
- Affected
- from 3.3.1 before 3.4.3
- Remediation
- Update to 3.4.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Mixed Media Gallery Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The Mixed Media Gallery Blocks (SimpLy Gallery) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unauthorized global preset updates in versions 3.3.1 up to, and including, 3.4.2. The 'update_option' operation of the pgc_sgb_action_wizard AJAX action writes the gallery skin presets and the global lightbox preset without any capability check, and the nonce it requires is printed on the wp-admin dashboard for every logged-in user. Preset values are not sanitized after the request is decoded, and values such as the lightbox copyright notice and the tag filter labels are later inserted into pages as HTML. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts that execute for visitors of pages that load the global lightbox or a gallery using the modified preset.
References
- https://wpsec.com/vuln/WPSEC-2026-0278/
- https://plugins.svn.wordpress.org/simply-gallery-block/tags/3.4.3/
- https://wordpress.org/plugins/simply-gallery-block/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS