Junglewise Threat Intelligence

CVE-2026-5743: gallerycreator SimpLy Gallery Block & Lightbox Stored XSS in block attributes

CVE-2026-5743 · Severity: medium · CVSS 6.4 · Published 2026-07-11

Executive brief

The SimpLy Gallery Block & Lightbox plugin for WordPress, which is used to create image galleries and lightboxes, contains a security flaw that allows users with Author-level permissions or higher to inject malicious scripts into website pages. These scripts will automatically run in the browser of any visitor who views the affected page. This could lead to unauthorized actions being performed on behalf of site visitors or the theft of sensitive session information.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the SimpLy Gallery Block & Lightbox plugin due to insufficient input sanitization and output escaping on the 'sliderMaxHeight' block attribute within the pgc_sgb_render_callback() function. The root cause is a flawed regular expression in the pgc_sgb_sanitize_custom_css() function that only filters quoted event handlers (e.g., onfocus="...") but fails to detect unquoted event handlers (e.g., onfocus=...). Authenticated attackers with Author-level privileges or higher can exploit this by injecting malicious JavaScript into block attributes. The scripts are then stored and executed in the context of any user's browser session when they visit the compromised page. A patch was introduced in version 3.3.3.2.

Affected products

  • gallerycreator SimpLy Gallery Block & Lightbox up to, and including, 3.3.3.2

Timeline

  • 2026-07-11: disclosed
  • 2026-07-11: advisory

References