Description

The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-28T16:17:56.640Z",
  "pubdate": "2026-08-28T16:17:56.640Z",
  "executiveSummary": "The Envira Gallery plugin for WordPress, in versions up to and including 1.12.4, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThe vulnerability originates from insufficient input sanitization and output escaping mechanisms within the plugin's gallery configuration interface, specifically targeting the 'description' field.\nAn attacker possessing Author-level permissions or higher can inject malicious JavaScript payloads into the description field of a gallery.\nWhen a victim, including administrative users, views a page where the compromised gallery is rendered, the injected script executes within the context of the victim's session.\nThis vulnerability poses a significant risk to site integrity and user security, as successful exploitation may lead to unauthorized actions performed on behalf of authenticated users, session hijacking, or site-wide configuration changes.\nExploitation requires authenticated access to the WordPress dashboard with sufficient privileges to modify gallery settings.\nThe flaw underscores the necessity for robust input validation and context-aware output encoding for all user-supplied data within the WordPress ecosystem.",
  "technicalDetails": "The vulnerability is categorized as Stored Cross-Site Scripting (XSS), stemming from the application's failure to adequately sanitize user-supplied input or properly encode output within the 'description' configuration parameter of the Envira Gallery plugin.\nThe vulnerable component resides in the backend configuration logic responsible for handling gallery metadata. When a user with Author-level access or higher submits a gallery description, the plugin fails to strip or neutralize potentially malicious HTML tags and JavaScript event handlers.\nThe attack flow begins when an attacker, authorized as an Author or higher, navigates to the Envira Gallery management interface. By inputting a crafted payload—such as a <script> tag or an HTML element containing event attributes like 'onload' or 'onerror'—into the 'description' field, the attacker saves the malicious content directly to the WordPress database.\nThe payload remains stored in the database associated with the specific gallery configuration. Upon the next request to render the gallery on the front-end or within a preview window, the application retrieves the stored description string and reflects it directly into the HTML document structure without applying appropriate context-sensitive output encoding.\nWhen a victim visits the page displaying the compromised gallery, the browser interprets the injected script as legitimate code originating from the trusted domain. This triggers the execution of the payload within the victim's browser session, constrained by the same-origin policy.\nThe post-exploitation impact is severe. Because the script executes in the context of the victim's session, an attacker can perform actions that the user is authorized to perform, such as modifying plugin settings, creating new administrator accounts, or exfiltrating sensitive cookies. If the victim possesses high-level privileges, the impact can escalate to full site compromise.\nThis issue affects all versions of Envira Gallery up to and including 1.12.4. It is fundamentally an input-output integrity issue where the application assumes that input received via the administrative interface is benign, failing to implement a 'never trust user input' security model at the point of data storage and subsequent display."
}