Description

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T05:16:47.537Z",
  "pubdate": "2026-08-16T05:16:47.537Z",
  "executiveSummary": "The Fullscreen Galleria plugin for WordPress is susceptible to a generic SQL Injection vulnerability via the 'href' attribute embedded within post content. This security flaw impacts all versions up to, and including, 1.6.12. The vulnerability arises from insufficient escaping of user-supplied input and a complete lack of proper query preparation when interacting with the underlying database. Consequently, authenticated malicious actors possessing contributor-level access privileges or higher can manipulate database queries by appending arbitrary SQL commands. This capability facilitates the unauthorized extraction of sensitive information residing within the database, potentially leading to a broader compromise of the affected WordPress site's data integrity and confidentiality. Successful exploitation requires authenticated access at the contributor tier, meaning an attacker must first obtain valid user credentials with adequate permissions to publish or submit post content containing the malicious 'href' attribute payload.",
  "technicalDetails": "The vulnerability is classified as a generic SQL Injection flaw residing within the Fullscreen Galleria plugin for WordPress, specifically affecting all versions up to, and including, 1.6.12. The root cause of the vulnerability stems from inadequate sanitization, lack of proper input escaping on the user-supplied 'href' parameter within post content, and the absence of parameterized queries or prepared statements when the application dynamically constructs database queries. The vulnerable component processes user input embedded inside the 'href' attribute of post content and concatenates it directly into existing SQL statements executed by the database management system.\nExploitation of this vulnerability requires an authenticated attacker to possess at least contributor-level access privileges. With these privileges, the attacker can create or edit post content, injecting a specially crafted payload into the 'href' attribute. Because the application fails to adequately escape the user-supplied parameter or utilize query preparation mechanisms, the database engine interprets the malicious input as executable SQL commands rather than literal string data. This permits the attacker to break out of the intended query context and append additional SQL queries, such as UNION-based statements or stacked queries depending on the database configuration.\nThe attack flow proceeds as follows: First, the authenticated attacker with contributor privileges crafts a malicious post containing a manipulated 'href' attribute designed to alter the logic of the underlying database query. Second, the user submits or saves the post content. Third, when the Fullscreen Galleria plugin processes the post content, it extracts the unsafe parameter and concatenates it into an active SQL query without prior sanitization or proper preparation. Fourth, the database executes the modified query containing the injected SQL commands. Finally, the attacker receives the output or extracts sensitive information from the database, such as user credentials, configuration data, or other restricted records, resulting in severe data exposure and potential escalation of unauthorized access within the application environment."
}