Security Alert Summary
The Envira Gallery plugin for WordPress is affected by a stored Cross-Site Scripting (XSS) vulnerability in the gallery “description” configuration field. Insufficient input sanitization and output escaping allow authenticated users with Author-level access or higher to inject scripts that execute when pages display the gallery description.
CVE Details
- CVE ID: CVE-2026-3423
- Affected component: Envira Gallery plugin for WordPress (gallery “description” configuration field)
- Affected versions: All versions up to and including 1.12.4
- Published: August 28, 2026 at 4:17:56 PM UTC
- Last modified: August 28, 2026 at 4:17:56 PM UTC
- CVSS v3.1: Base score 6.4, MEDIUM
- Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: LOW
- User Interaction: NONE
- Scope: CHANGED
- Confidentiality Impact: LOW
- Integrity Impact: LOW
- Availability Impact: NONE
- Vector:
- Authentication / privileges required: Authenticated attacker with Author-level access or higher (PR: LOW)
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
The vulnerability is a stored Cross-Site Scripting (XSS) issue in the gallery “description” configuration field. Because the plugin does not sufficiently sanitize input and does not properly escape output, an authenticated user with Author-level privileges or higher can save a payload that will be rendered as executable script code when a page displays the gallery description.
Code paths referenced in the public analysis point to the plugin’s REST handlers and shortcode rendering logic (files such as includes/global/rest.php and includes/global/shortcode.php) where the description value is processed and output. The root cause is insufficient input sanitization on save and missing output escaping on render, which allows persisted script injection.
The practical impact is limited to what an injected script can access in the browser context of users who view the affected gallery pages. This can include reading or exfiltrating data visible to the user, manipulating the displayed page content for phishing, or performing actions available to that user’s session in the browser.
How This Could Impact Your Website
Consider a site with multiple users: the site owner, internal staff members with Editor or Author roles, and external contributors who have Author-level access to upload or edit content. An attacker who can create or edit a gallery description (for example, an attacker who has obtained Author-level access or is a trusted contributor) could insert a script into a gallery description. When other staff or site visitors view a page with that gallery and description enabled, the script runs in their browsers.
- Users who view the gallery could have information accessible in their browser context exposed, such as profile data shown on the page or values retrievable via client-side requests.
- Internal user email addresses or other contact details that appear on the site could be harvested by injected scripts, increasing the risk of targeted phishing or social engineering against staff.
- Injected content could be used to modify the displayed page to trick users into submitting credentials or other sensitive information to an attacker-controlled endpoint.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially Author-level access for untrusted users and contributors.
- Enforce strong passwords and enable two-factor authentication for Editors and Administrators.
- Remove unused or unmaintained plugins and themes from your installation.
- Monitor site activity and logs for unusual behavior, such as unexpected content changes or new galleries created by low-privileged accounts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/rest.php#L192
- https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/rest.php#L239
- https://plugins.trac.wordpress.org/browser/envira-gallery-lite/trunk/includes/global/shortcode.php#L807
- https://plugins.trac.wordpress.org/changeset/3514026/envira-gallery-lite/trunk/includes/global/shortcode.php?old=3465371&old_path=envira-gallery-lite%2Ftrunk%2Fincludes%2Fglobal%2Fshortcode.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/17de5b96-7a61-4f37-a921-6a023cc40812?source=cve
