CVE-2026-104652
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize and escape a gallery item identifier before outputting it in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
Risk Assessment
Script injection can lead to administrator session hijacking, data theft, or malware propagation.
Recommendation
Update the Envira Gallery plugin to version 1.16.1 or later if available, and restrict user permissions.
Other vulnerabilities in Envira Gallery
See all- CVE-2026-104653Medium
The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize or escape user-supplied gallery display configuration values before storing and outputting them in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
- CVE-2026-3423Medium
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to and including 1.12.4 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access or above to inject arbitrary web scripts that execute whenever a user accesses a page displaying the gallery with a description enabled.
Original NVD description (English source)
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS