CVE-2026-104653 in Envira Gallery Plugin
Summary
by MITRE • 10/07/2026
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Envira Gallery versions prior to 1.16.1 represents a classic Stored Cross-Site Scripting flaw rooted in insufficient input validation and output encoding mechanisms within the WordPress plugin architecture. The core technical deficiency lies in the failure of the application to sanitize or escape user-supplied gallery display configuration values before they are persisted to the database and subsequently rendered into HTML image tag attributes. This lack of proper data handling allows malicious actors with Author-level privileges or higher to inject arbitrary JavaScript code directly into the page structure. Because the vulnerability is stored within the site's content rather than being limited to a single session, it persists across multiple visits and affects all users who view pages containing the compromised gallery elements.
From an operational perspective, this flaw enables attackers to execute malicious scripts in the context of any visitor viewing the affected page, including administrators with full control over the WordPress installation. This capability significantly escalates the severity of the issue beyond typical client-side script injection attacks. An attacker can leverage this vector to steal administrative session cookies, perform actions on behalf of authenticated users such as modifying site settings or creating new admin accounts, and redirect visitors to phishing sites designed to harvest credentials. The impact is particularly severe because it bypasses standard security expectations for content creators who are typically granted limited permissions but inadvertently become vectors for compromising the entire platform due to inadequate output encoding in dynamic HTML generation processes.
This vulnerability aligns with Common Weakness Enumeration category CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves a failure to apply context-appropriate escaping when embedding user-controlled data into an attribute value within an HTML tag. Furthermore, the exploitation path corresponds to MITRE ATT&CK technique T1059, specifically sub-technique 007 for Command and Scripting Interpreter: JavaScript, as it facilitates the execution of client-side scripts through browser interpretation rather than server-side command injection. The attack vector is classified under Input Validation failures where trusted roles are assumed safe without rigorous sanitization protocols applied to dynamic content generation functions.
Mitigation strategies must prioritize immediate upgrading to version 1.16.1 or later, which addresses the input validation and output encoding deficiencies in the gallery display configuration handling logic. For environments unable to upgrade immediately, administrators should implement strict role-based access controls to restrict who can create galleries with custom configurations, effectively limiting exposure to users with higher privilege levels only if absolutely necessary. Additionally, deploying a Web Application Firewall capable of detecting and blocking reflected or stored script injection patterns in form submissions related to gallery settings can provide an additional layer of defense. Regular security audits focusing on output encoding practices for all dynamic content rendered within HTML attributes are essential to prevent similar vulnerabilities from emerging in other plugins or custom code segments that handle user-supplied data.