Envira Gallery <= 1.16.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Configuration Values
- ID
- WPSEC-2026-0349
- Plugin
- Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More (envira-gallery-lite)
- Affected
- from 1.8.5 before 1.16.1
- Remediation
- Update to 1.16.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Envira Gallery on WPSec AttackSurface
- Fix released
- Published
Description
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API gallery_data field in versions 1.8.5 through 1.16.0. The REST writer stored the crop_width and crop_height settings and gallery item IDs without validation, and a config value sent as a string skipped the sanitizer entirely and was parsed into arbitrary settings, including justified_gallery_theme and justified_row_height. These values were printed unescaped into image attributes and an inline JavaScript options object. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that execute whenever a user views a page or preview that embeds the gallery.
References
- https://wpsec.com/vuln/WPSEC-2026-0349/
- https://plugins.svn.wordpress.org/envira-gallery-lite/tags/1.16.1/
- https://wordpress.org/plugins/envira-gallery-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS