CVE-2026-104681
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Envira Gallery WordPress plugin before version 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
Risk Assessment
Disclosure of private and unpublished content can breach data confidentiality and user privacy, leading to leakage of sensitive information.
Recommendation
Update the Envira Gallery plugin to version 1.16.2 or later, which includes the security fix.
Other vulnerabilities in Envira Gallery
See all- CVE-2026-104684Low
The Envira Gallery WordPress plugin before version 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
- CVE-2026-104682Low
The Envira Gallery WordPress plugin before version 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
- CVE-2026-104653Medium
The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize or escape user-supplied gallery display configuration values before storing and outputting them in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
- CVE-2026-104652Medium
The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize and escape a gallery item identifier before outputting it in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
- CVE-2026-3423Medium
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to and including 1.12.4 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access or above to inject arbitrary web scripts that execute whenever a user accesses a page displaying the gallery with a description enabled.
Original NVD description (English source)
The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS