Executive brief
Envira Gallery is a popular WordPress plugin for managing and displaying photo galleries on websites. The plugin fails to properly sanitize user input in the gallery description field, allowing authenticated users with Author-level permissions to inject malicious scripts. When other users view pages containing affected galleries, these injected scripts execute in their browsers, potentially compromising account credentials, stealing sensitive data, or redirecting users to malicious sites.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in Envira Gallery versions up to 1.12.4, caused by insufficient input sanitization and output escaping of the gallery 'description' configuration field. The attack requires authenticated access at Author level or above; an attacker injects arbitrary JavaScript code into the description field which is then permanently stored in the WordPress database. When any user visits a page displaying the gallery with description enabled, the malicious script executes in their browser context. This could lead to session hijacking, credential theft, or malware distribution. A patch addressing the sanitization and escaping is likely available in versions beyond 1.12.4.
Affected products
- Envira Gallery up to and including 1.12.4
Timeline
- 2026-08-28: disclosed