Executive brief
Envira Gallery Lite is a popular WordPress plugin used to create and manage image galleries. A security flaw allows users with 'Author' level permissions or higher to inject malicious scripts into gallery pages. When other users or administrators visit these pages, the scripts execute automatically, which could lead to unauthorized actions or data theft.
Technical details
The Envira Gallery Lite plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the update_gallery_data() function and improper output escaping in the gallery_init() function. Specifically, the sanitize_config_values() function fails to sanitize the 'arrows' parameter. When this parameter is subsequently rendered in an inline JavaScript configuration, the plugin uses esc_attr(), which is insufficient for JavaScript contexts and allows for expression injection. Authenticated attackers with Author-level privileges can exploit this via the REST API to inject malicious scripts. A patch appears to be available in versions following 1.12.4.
Affected products
- Envira Gallery Envira Gallery Lite up to and including 1.12.4
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
References
- https://plugins.trac.wordpress.org/browser/envira-gallery-lite/tags/1.12.4/includes/global/rest.php
- https://plugins.trac.wordpress.org/browser/envira-gallery-lite/tags/1.12.4/includes/global/shortcode.php
- https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/rest.php
- https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/shortcode.php
- https://plugins.trac.wordpress.org/changeset/3514026/envira-gallery-lite/trunk/includes/global/shortcode.php?old=3465371&old_path=envira-gallery-lite%2Ftrunk%2Fincludes%2Fglobal%2Fshortcode.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b1e973-f22d-4e69-b3b8-d6ea5df3f047?source=cve