CVE-2025-26931: Tribulant Gallery Voting CSRF Vulnerability

CVE-2025-26931 Overview

CVE-2025-26931 is a Cross-Site Request Forgery (CSRF) vulnerability in the Tribulant Gallery Voting plugin for WordPress that leads to Stored Cross-Site Scripting (XSS). The flaw affects all plugin versions up to and including 1.2.1. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, injects persistent JavaScript into the WordPress site.

Critical Impact

A successful attack stores attacker-controlled scripts in the gallery voting plugin. The scripts execute in the browsers of site visitors and administrators, enabling session theft, account takeover, and further compromise of the WordPress installation.

Affected Products

• Tribulant Gallery Voting plugin for WordPress
• All versions from n/a through 1.2.1
• WordPress sites with the gallery-voting plugin installed and active

Discovery Timeline

• 2025-02-25 - CVE-2025-26931 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26931

Vulnerability Analysis

The vulnerability combines two distinct weaknesses in the gallery-voting plugin. First, the plugin fails to validate the origin of state-changing requests through CSRF tokens or nonces [CWE-352]. Second, input submitted through those requests is rendered back without proper output encoding, producing a Stored XSS condition.

An attacker hosts a page containing a forged request targeting a vulnerable plugin endpoint. When an authenticated WordPress administrator loads that page, the browser submits the request with the admin's session cookies. The plugin processes the request as legitimate and persists attacker-controlled HTML or JavaScript in the database.

The stored payload executes whenever a user views the affected gallery or admin screen. Exploitation requires user interaction from a privileged victim, but no authentication on the attacker's side.

Root Cause

The root cause is the absence of CSRF protection on plugin actions that modify persistent data, combined with missing input sanitization and output escaping. WordPress provides wp_nonce_field() and check_admin_referer() primitives for CSRF defense and esc_html(), esc_attr(), and wp_kses() for output encoding. The plugin does not consistently apply these controls.

Attack Vector

The attack proceeds over the network and requires the victim to interact with attacker-controlled content. A typical scenario involves an administrator clicking a link in a phishing email or visiting a compromised site that issues a forged POST request to the WordPress installation. The administrator's authenticated session is used to write malicious script content into a gallery voting record. Subsequent page loads deliver the script to anyone viewing the affected resource. Technical details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-26931

Indicators of Compromise

• Unexpected <script>, onerror, or onload attributes stored in wp_options, wp_postmeta, or gallery voting database tables.
• WordPress administrator sessions making POST requests to gallery-voting plugin endpoints with HTTP Referer headers pointing to external domains.
• New or modified administrator accounts, plugin installations, or theme edits following an admin browser session.

Detection Strategies

• Audit gallery voting plugin records for HTML or JavaScript content that should not appear in user-supplied fields.
• Inspect web server access logs for cross-origin POST requests targeting plugin handlers and admin-ajax endpoints associated with gallery-voting.
• Use a web application firewall (WAF) or WordPress security scanner to flag stored XSS payloads in plugin tables.

Monitoring Recommendations

• Alert on changes to WordPress administrator accounts, user roles, and plugin or theme files.
• Capture and review browser console errors from administrators that indicate unexpected script execution on plugin pages.
• Monitor outbound network connections from administrator browsers during WordPress sessions for beaconing to unknown hosts.

How to Mitigate CVE-2025-26931

Immediate Actions Required

• Deactivate the Tribulant Gallery Voting plugin on all WordPress instances running version 1.2.1 or earlier until a patched release is confirmed installed.
• Force a password reset and session invalidation for all WordPress administrator accounts.
• Review the gallery voting database tables and remove any unexpected HTML or JavaScript content from stored records.

Patch Information

At the time of publication, the NVD entry and the Patchstack Vulnerability Report list the vulnerability as affecting versions through 1.2.1. Administrators should monitor the plugin vendor and the WordPress plugin repository for a fixed release and apply it as soon as it is available.

Workarounds

• Remove or disable the gallery-voting plugin until a fixed version is available.
• Deploy a web application firewall rule that blocks cross-origin POST requests to WordPress admin endpoints lacking a valid nonce.
• Restrict WordPress administrator browsing to dedicated, hardened workstations to reduce CSRF exposure from general web traffic.
• Enable Content Security Policy (CSP) headers that disallow inline scripts on WordPress admin and gallery pages to limit XSS payload execution.