CVE-2025-46476: Awesome WP Image Gallery Stored XSS Flaw

CVE-2025-46476 Overview

CVE-2025-46476 is a stored cross-site scripting (XSS) vulnerability in the Awesome Wp Image Gallery WordPress plugin developed by nayon46. The flaw affects all plugin versions up to and including 1.0. It stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. Authenticated attackers with low privileges can inject persistent JavaScript payloads that execute in the browser of any user who views the affected page. The vulnerability requires user interaction to trigger and impacts confidentiality, integrity, and availability across security scopes.

Critical Impact
Attackers can inject stored JavaScript payloads that hijack sessions, steal credentials, or perform actions in the context of authenticated administrators viewing the affected gallery pages.

Affected Products

Awesome Wp Image Gallery plugin (slug: awesome-wp-image-gallery)
All versions from initial release through 1.0
WordPress installations with the plugin activated

Discovery Timeline

2025-04-24 - CVE CVE-2025-46476 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46476

Vulnerability Analysis

The Awesome Wp Image Gallery plugin fails to sanitize user-controlled input before rendering it in generated HTML output. Contributor-level or higher users can submit crafted input containing JavaScript payloads through plugin fields intended for gallery configuration or content. The malicious content is persisted in the WordPress database and served to visitors without proper encoding.

When a victim loads the affected page, the browser parses the injected markup as executable script. Because the payload is stored rather than reflected, exploitation does not require phishing links and affects every visitor to the compromised page. The scope change indicated by the vulnerability metrics reflects that the injected script executes in the browser context of users who did not authorize the malicious content.

Root Cause

The root cause is missing or insufficient output encoding when the plugin renders user-supplied gallery data. WordPress provides sanitization functions such as esc_html(), esc_attr(), and wp_kses() for this purpose. The plugin does not consistently apply these functions to attacker-controlled fields before echoing them to the DOM.

Attack Vector

An authenticated attacker with contributor-level access or higher submits a payload containing HTML or JavaScript through a plugin input field. WordPress stores the value in the database. When an administrator or site visitor loads a page that renders the gallery, the browser executes the payload. Successful exploitation can result in session token theft, forced administrative actions via CSRF chaining, credential harvesting through injected forms, or redirection to attacker-controlled infrastructure.

See the Patchstack XSS Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2025-46476

Indicators of Compromise

Unexpected <script>, <iframe>, or on* event handler attributes stored in WordPress wp_posts or plugin-specific tables
Outbound requests from browsers to unfamiliar domains originating from pages that render the gallery
Newly created administrator accounts or modified user roles following gallery page access
Injected content referencing external JavaScript files not associated with legitimate site assets

Detection Strategies

Review database entries associated with the awesome-wp-image-gallery plugin for HTML tags and JavaScript event handlers
Deploy web application firewall rules that inspect POST requests to plugin endpoints for XSS payload patterns
Correlate contributor-level user activity with subsequent DOM modifications on gallery pages
Enable Content Security Policy (CSP) reporting to surface script executions from unauthorized origins

Monitoring Recommendations

Monitor WordPress audit logs for gallery item creation and modification events by low-privilege accounts
Track browser telemetry for anomalous script execution on pages hosting the plugin
Alert on administrator sessions that trigger CSP violations or unexpected authenticated API calls
Log and review all plugin configuration changes with timestamps and user attribution

How to Mitigate CVE-2025-46476

Immediate Actions Required

Deactivate and remove the Awesome Wp Image Gallery plugin until a patched version is released
Audit all gallery entries created by contributor or author accounts and remove suspicious HTML content
Rotate credentials for any administrator who accessed gallery pages after the plugin was installed
Restrict contributor and author role assignments to trusted users only

Patch Information

At the time of publication, no patched version of the Awesome Wp Image Gallery plugin has been released. Versions through 1.0 remain vulnerable. Site administrators should monitor the Patchstack advisory and the WordPress plugin repository for updates.

Workarounds

Uninstall the plugin and replace it with an actively maintained gallery alternative
Enforce a strict Content Security Policy that blocks inline scripts and unauthorized external origins
Deploy a WordPress web application firewall with rules targeting stored XSS injection patterns
Limit user registration and reduce the number of accounts with content-creation privileges

bash

# Content Security Policy header example for WordPress
# Add to .htaccess or web server configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';"
Header set X-XSS-Protection "1; mode=block"
Header set X-Content-Type-Options "nosniff"