CVE-2026-107757 in Gallery Custom Links Plugin
Summary
by MITRE • 10/15/2026
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires two coordinated inputs from the same authenticated attacker: an HTML comment payload stored in a comment body (preserved verbatim by WordPress comment kses) and a matching simple_html_dom noise key placed in the attacker's display_name (which survives esc_attr() intact), with substitution occurring after both filters have run during the plugin's default-on output-buffering pass over the full rendered page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within the Gallery Custom Links plugin for WordPress, affecting versions up to and including 2.3.3, represents a sophisticated Stored Cross-Site Scripting (XSS) flaw rooted in insufficient input sanitization and output escaping mechanisms. This security defect allows authenticated attackers possessing subscriber-level access or higher privileges to inject arbitrary web scripts into pages that execute upon user interaction. The complexity of this exploit lies not merely in the injection itself but in the specific coordination required between two distinct parameters within the WordPress ecosystem, leveraging a unique attack vector that bypasses standard protective filters through timing and context manipulation.
The technical mechanism relies on a dual-input strategy orchestrated by the attacker to circumvent WordPress's built-in security measures. The first component involves an HTML comment payload stored within the body of a user-generated comment submitted via wp-comments-post.php. WordPress typically processes comments through kses, a filtering system designed to strip dangerous tags and attributes while preserving certain safe elements like HTML comments. In this scenario, the attacker successfully injects a malicious script disguised as or embedded within an HTML comment that survives the kses filter intact due to its specific formatting which avoids triggering standard removal rules for scripts inside comments under normal circumstances.
The second component of the exploit involves modifying the attacker's display_name field via profile.php. Normally, WordPress applies esc_attr() functions to user-facing data like display names to ensure they are safely encoded for HTML attribute contexts, preventing direct script execution from such fields. However, in this specific vulnerability chain, a noise key associated with simple_html_dom is placed within the display name. This key survives the esc_attr() encoding process because it does not contain characters that trigger standard escaping behaviors but serves as a unique identifier or marker rather than executable code itself at this stage.
The critical failure occurs during the plugin's default-on output-buffering pass over the full rendered page. After both the comment and display name have been processed by their respective initial filters, the Gallery Custom Links plugin performs an additional parsing step using simple_html_dom to generate gallery links or related content. During this phase, the plugin searches for specific patterns within the buffered HTML output. It identifies the noise key present in the escaped display_name and substitutes it with the raw, unescaped payload stored in the comment body. Because this substitution happens after the initial escaping filters have run, the malicious script is injected into the final rendered page without being encoded or neutralized by WordPress's standard security layers.
This vulnerability aligns closely with CWE-79, which categorizes improper neutralization of input during web page generation known as Cross-site Scripting. The specific nature of this attack also reflects aspects of ATT&CK technique T1059, Command and Scripting Interpreter, specifically through the use of browser-based scripting languages like JavaScript to execute arbitrary code on behalf of victims. The requirement for authenticated access places it within the scope of privilege escalation or abuse of existing valid credentials rather than unauthenticated remote exploitation, yet the impact remains severe due to the stored nature of the payload which affects all subsequent viewers of the affected pages.
The operational impact of this vulnerability is significant as it enables persistent malicious activity on a WordPress site without requiring repeated injections for each victim session. Once an attacker successfully executes this two-step injection process, any user who views the compromised page will have their browser execute the injected scripts in the context of the vulnerable website. This can lead to account hijacking through session cookie theft, defacement of the website content, redirection to malicious phishing sites, or further propagation of malware within the organization's network if internal resources are accessible from the web-facing application.
Mitigation strategies must focus on immediate remediation and enhanced input validation practices. The primary recommendation is to update the Gallery Custom Links plugin to a version beyond 2.3.3 where this specific output-buffering substitution flaw has been addressed by the developers. In addition to updating, administrators should enforce strict Content Security Policy (CSP) headers which can restrict the execution of inline scripts and limit the sources from which JavaScript can be loaded, thereby mitigating the impact even if an XSS vector is discovered. Implementing Web Application Firewalls with advanced behavioral analysis capabilities can also help detect and block attempts to inject complex multi-stage payloads that exhibit patterns consistent with this type of coordinated attack.
Furthermore, developers should review how output buffering interacts with third-party HTML parsing libraries like simple_html_dom when processing user-supplied data from multiple sources within the same request lifecycle. Ensuring that any substitution or replacement operations performed on buffered content apply appropriate escaping functions to the injected values is crucial for preventing such bypasses. Security audits should specifically target scenarios where data flows between different storage mechanisms and rendering contexts, as these transitions often present opportunities for filter evasion if not carefully managed with consistent sanitization protocols throughout the entire application stack.