CVE-2026-104653: Envira Gallery WordPress XSS Vulnerability

CVE-2026-104653 Overview

CVE-2026-104653 is a stored Cross-Site Scripting (XSS) vulnerability in the Envira Gallery WordPress plugin before version 1.16.1. The plugin fails to sanitize or escape user-supplied gallery display configuration values before storing them and rendering them inside an image tag attribute. Authenticated users with Author role or higher can inject arbitrary JavaScript that executes in the browser of any visitor viewing a page containing the affected gallery, including administrators. The flaw is classified under CWE-79.

Critical Impact
An authenticated contributor-level attacker can hijack administrator sessions, perform actions on behalf of the admin, or pivot to full site takeover when an administrator views the poisoned gallery.

Affected Products

Envira Gallery WordPress plugin versions prior to 1.16.1
WordPress sites allowing Author role or higher to create or edit galleries
Any page or post embedding an affected Envira Gallery shortcode

Discovery Timeline

2026-10-07 - CVE-2026-104653 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104653

Vulnerability Analysis

The vulnerability resides in how Envira Gallery handles gallery display configuration values. User-supplied input is accepted from authenticated users with Author privileges or higher during gallery configuration. The plugin stores these values without sanitization and later outputs them inside an HTML image tag attribute without escaping.

Because the sink is an attribute context, an attacker can break out of the attribute by including a quote character followed by an event handler such as onerror or onload. When any visitor loads a page containing the gallery, the browser parses the injected attribute and executes the attacker-controlled JavaScript. The attack succeeds against higher-privilege users, including administrators, enabling privilege escalation via session theft or forced administrative actions.

Root Cause

The root cause is missing output escaping on gallery display configuration fields when they are rendered as HTML attribute values. The plugin does not call esc_attr() or an equivalent WordPress escaping function on stored metadata before inclusion in the <img> tag. Input validation on write is also absent, so the malicious payload persists in the database.

Attack Vector

Exploitation requires an authenticated account with Author role or above and relies on an administrator or other visitor loading the affected gallery page. The attacker edits a gallery, submits a crafted display configuration value containing an attribute-breakout payload, and publishes a page or post embedding the gallery. Any subsequent view of that page triggers execution of the injected script in the victim's browser session. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-104653

Indicators of Compromise

Envira Gallery post meta entries containing characters such as ", <, onerror=, onload=, or javascript: within gallery configuration fields
Unexpected <script> tags or inline event handlers in rendered gallery HTML output
Administrator sessions showing anomalous REST API or admin-ajax requests originating from gallery pages
New administrator accounts, plugin installations, or theme file modifications following a gallery page view

Detection Strategies

Audit the wp_postmeta table for Envira Gallery entries and inspect display configuration values for HTML control characters
Review browser console logs or Content Security Policy (CSP) violation reports from pages hosting Envira galleries
Correlate authenticated Author-level content edits with subsequent administrator activity in web server access logs

Monitoring Recommendations

Enable WordPress audit logging to capture gallery create, edit, and publish events by non-administrator roles
Monitor outbound requests from administrator browsers to unknown domains after loading gallery pages
Alert on creation of privileged accounts or plugin installs that follow Author-role content changes

How to Mitigate CVE-2026-104653

Immediate Actions Required

Update the Envira Gallery plugin to version 1.16.1 or later on all WordPress installations
Review existing galleries for suspicious display configuration values and remove any containing script payloads
Rotate administrator credentials and invalidate active sessions if exploitation is suspected
Audit user roles and remove unnecessary Author or higher privileges from untrusted accounts

Patch Information

The vendor addressed the vulnerability in Envira Gallery 1.16.1 by introducing proper sanitization and output escaping on gallery display configuration values. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI. Confirm the installed version from the Plugins page after upgrade.

Workarounds

Restrict gallery editing capabilities to trusted Editor and Administrator accounts until the patch is applied
Deploy a Web Application Firewall (WAF) rule that blocks HTML attribute-breakout patterns in Envira gallery save requests
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and event handlers on pages rendering galleries

bash

# Update Envira Gallery via WP-CLI
wp plugin update envira-gallery-lite --version=1.16.1
wp plugin list --name=envira-gallery-lite --fields=name,status,version