Security Alert Summary
The Gallagher Website Design WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the login_link shortcode. Insufficient input sanitization and output escaping of the prefix attribute allow authenticated users with Contributor-level access or higher to inject scripts that execute when a page is viewed.
CVE Details
- CVE ID:
CVE-2026-1913 - Affected component: Gallagher Website Design plugin for WordPress (login_link shortcode)
- Affected versions: all versions up to, and including, 2.6.4
- Published: April 22, 2026 at 10:16:50 AM UTC
- Last modified: April 22, 2026 at 10:16:50 AM UTC
- CVSS v3.1: Base score 6.4 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges: Requires an authenticated user with low privileges (Contributor-level or higher)
- User interaction: None required for exploit to trigger
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Cross-site Scripting)
Technical Details
This is a stored cross-site scripting vulnerability. The plugin does not sufficiently sanitize input or escape output for the prefix attribute of its login_link shortcode. As a result, an attacker who can edit content using a Contributor-level account or higher can store arbitrary script content in a site page or post. When another user views the affected page, the injected script will execute in that user’s browser context.
The underlying issue is missing input validation and output escaping around the prefix attribute for the login_link shortcode. The description indicates the problem is present in all versions up to and including 2.6.4.
How This Could Impact Your Website
Consider a site where multiple people contribute content: a site owner, internal staff who publish posts, and external contributors or contractors. A contributor who can add or edit content could insert a malicious prefix value via the login_link shortcode. When other administrators, editors, or visitors view that page, injected scripts could run and potentially read or transmit page-level data accessible in the browser.
Practical consequences can include exposure of non-sensitive user data displayed on pages, increased risk of targeted phishing or social engineering against staff whose information is visible, and manipulation of page content visible to visitors. These impacts align with the CVSS ratings of low confidentiality and integrity impact rather than full site takeover. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity for unusual behavior.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/gallagher-website-design/tags/2.6.4/gallagher-website-design.php#L203
- https://plugins.trac.wordpress.org/browser/gallagher-website-design/trunk/gallagher-website-design.php#L203
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3454227%40gallagher-website-design&new=3454227%40gallagher-website-design&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d013ae-a512-454a-bcfc-8725a6928fee?source=cve
