CVE-2026-3423
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to and including 1.12.4 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Author-level access or above to inject arbitrary web scripts that execute whenever a user accesses a page displaying the gallery with a description enabled.
Risk Assessment
An attacker can inject malicious scripts that execute in visitors' browsers, potentially leading to data theft, session hijacking, or malware distribution.
Recommendation
Update the Envira Gallery plugin to the latest patched version. Additionally, restrict gallery editing permissions to trusted users only.
Other vulnerabilities in Envira Gallery
See all- CVE-2026-104684Low
The Envira Gallery WordPress plugin before version 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
- CVE-2026-104682Low
The Envira Gallery WordPress plugin before version 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.
- CVE-2026-104681Low
The Envira Gallery WordPress plugin before version 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.
- CVE-2026-104653Medium
The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize or escape user-supplied gallery display configuration values before storing and outputting them in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
- CVE-2026-104652Medium
The WordPress plugin Envira Gallery (before 1.16.1) does not sanitize and escape a gallery item identifier before outputting it in an image tag attribute. Users with the Author role and above can inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
Original NVD description (English source)
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS