CVE-2026-104682

The Envira Gallery WordPress plugin before version 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.

The Envira Gallery WordPress plugin before version 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.

The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize or escape user-supplied gallery display configuration values before storing and outputting them in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.

The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize and escape a gallery item identifier before outputting it in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to and including 1.12.4 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access or above to inject arbitrary web scripts that execute whenever a user accesses a page displaying the gallery with a description enabled.