CVE-2025-26778: Gallery Plugin Stored XSS Vulnerability

CVE-2025-26778 Overview

CVE-2025-26778 is a stored Cross-Site Scripting (XSS) vulnerability in the Jordy Meow Gallery plugin for WordPress. The flaw affects all plugin versions up to and including 2.2.1. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. Authenticated attackers with high privileges can inject persistent JavaScript payloads that execute in the browsers of users viewing affected pages. The scope is marked as changed, meaning the injected script can impact resources beyond the vulnerable component.

Critical Impact

Stored XSS enables persistent script execution in the context of site visitors, allowing session theft, administrative action hijacking, and content defacement across the WordPress site.

Affected Products

• Jordy Meow Gallery plugin for WordPress
• Versions from n/a through 2.2.1 (inclusive)
• WordPress sites with the Gallery Custom Links plugin installed

Discovery Timeline

• 2025-02-17 - CVE-2025-26778 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26778

Vulnerability Analysis

The Jordy Meow Gallery plugin fails to properly sanitize or encode user-supplied input before rendering it within generated HTML output. An authenticated user with elevated privileges can inject arbitrary JavaScript into plugin-managed fields such as gallery metadata or custom link attributes. The injected payload is stored in the WordPress database and executed each time the affected page loads in a visitor's browser.

Because the CVSS scope is changed, the injected script can affect resources outside the plugin's security boundary. This includes session cookies, authenticated administrative sessions, and any content rendered in the same origin. User interaction is required, since a victim must load the page containing the stored payload.

Root Cause

The root cause is missing or insufficient output encoding when the plugin writes attacker-controlled data into HTML contexts. WordPress provides escaping functions such as esc_html(), esc_attr(), and wp_kses(), but the plugin does not apply them consistently to the vulnerable fields. The absence of input validation at write time compounds the issue.

Attack Vector

An authenticated attacker with high privileges (such as an editor or administrator) submits a crafted payload through a plugin interface that accepts gallery or custom-link input. The payload persists in the database. When another user, including unauthenticated visitors or higher-privileged administrators, views the affected gallery page, the script executes in their browser context. Refer to the Patchstack XSS Vulnerability Report for technical details.

Detection Methods for CVE-2025-26778

Indicators of Compromise

• Unexpected <script> tags or JavaScript event handlers (onerror, onload, onclick) stored in gallery-related wp_postmeta or wp_options entries
• Outbound requests from site visitors to unfamiliar external domains originating from gallery pages
• New or modified administrator accounts created shortly after gallery page views

Detection Strategies

• Audit the WordPress database for stored content in Gallery plugin tables containing HTML tags, encoded script characters, or JavaScript URI schemes
• Review web server access logs for POST requests to plugin admin endpoints containing script-like payloads
• Inspect browser Content Security Policy (CSP) violation reports for inline script attempts originating from gallery URLs

Monitoring Recommendations

• Enable WordPress audit logging to track content modifications made by privileged users through the Gallery plugin
• Monitor for anomalous session activity, such as administrative actions originating from unusual IP addresses after gallery page loads
• Deploy a Web Application Firewall (WAF) with signatures for stored XSS payload patterns targeting WordPress plugins

How to Mitigate CVE-2025-26778

Immediate Actions Required

• Update the Jordy Meow Gallery plugin to a version later than 2.2.1 once a patched release becomes available
• Audit all existing gallery entries and custom links for previously injected malicious content and remove them
• Restrict high-privilege WordPress accounts and enforce multi-factor authentication for editors and administrators

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 2.2.1. Site administrators should monitor the Patchstack advisory and the plugin's official WordPress repository page for a fixed release and apply it as soon as it becomes available.

Workarounds

• Temporarily deactivate the Gallery plugin if a patched version is not yet available and the functionality is non-essential
• Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
• Reduce the number of users with editor or administrator roles who can modify gallery content