CVE-2026-1236: Envira Gallery WordPress Plugin XSS Flaw

CVE-2026-1236 Overview

The Envira Gallery for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the justified_gallery_theme parameter in all versions up to, and including, 1.12.3. This vulnerability stems from insufficient input sanitization and output escaping within the plugin's shortcode processing functionality. Authenticated attackers with Author-level access and above can inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact
Authenticated attackers can inject persistent malicious scripts that execute in the context of other users' browser sessions, potentially leading to session hijacking, credential theft, or further site compromise.

Affected Products

Envira Gallery for WordPress (Lite) versions up to and including 1.12.3
WordPress installations using vulnerable Envira Gallery plugin versions
Sites with Author-level or higher user accounts

Discovery Timeline

2026-03-04 - CVE CVE-2026-1236 published to NVD
2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-1236

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the Envira Gallery plugin's shortcode processing mechanism. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The justified_gallery_theme parameter accepts user-controlled input that is stored in the database and later rendered on pages without proper sanitization or output escaping.

The attack requires network access and authentication with at least Author-level privileges. Because the malicious payload is stored rather than reflected, it persists across page loads and affects all users who view the compromised content. The scope is changed, meaning the vulnerability can impact resources beyond the vulnerable component's security scope, affecting confidentiality and integrity of user sessions.

Root Cause

The root cause lies in the shortcode.php file at line 302, where the justified_gallery_theme parameter is processed without adequate input validation and output encoding. When gallery content is rendered, the unescaped parameter value is inserted directly into the HTML output, allowing JavaScript code to execute in visitors' browsers. The plugin fails to implement proper WordPress sanitization functions such as esc_attr(), esc_html(), or wp_kses() on this user-controlled input before rendering.

Attack Vector

The attack is network-based and requires an authenticated attacker with at least Author-level access to WordPress. An attacker would craft a malicious gallery configuration containing JavaScript payloads in the justified_gallery_theme parameter. When any user (including administrators) views a page containing the compromised gallery, the injected script executes in their browser context. This could enable session cookie theft, keylogging, phishing content injection, or administrative action execution on behalf of the victim.

The vulnerability mechanism involves the shortcode parser accepting unsanitized theme parameter values during gallery creation or editing. The malicious payload is stored in the WordPress database and retrieved during page rendering without proper output escaping. For technical implementation details, refer to the WordPress Plugin Shortcode Code in the WordPress plugin repository.

Detection Methods for CVE-2026-1236

Indicators of Compromise

Unusual JavaScript code present in gallery configuration entries within the WordPress database
Suspicious justified_gallery_theme parameter values containing script tags, event handlers, or encoded payloads
User reports of unexpected browser behavior or redirects when viewing gallery pages
Web application firewall logs showing blocked XSS pattern attempts targeting gallery parameters

Detection Strategies

Implement content security policy (CSP) headers to restrict inline script execution and report violations
Deploy web application firewall (WAF) rules to detect and block XSS payloads in gallery-related POST requests
Enable WordPress audit logging plugins to monitor changes to gallery configurations by Author-level users
Conduct regular database scans for suspicious HTML/JavaScript content in gallery metadata tables

Monitoring Recommendations

Monitor WordPress user activity logs for unusual gallery creation or modification patterns
Set up alerts for CSP violation reports indicating script injection attempts
Review Author-level user accounts for signs of compromise that could enable exploitation
Implement real-time monitoring of gallery shortcode output for script injection patterns

How to Mitigate CVE-2026-1236

Immediate Actions Required

Update Envira Gallery plugin to the latest patched version immediately
Audit existing galleries for malicious content in the justified_gallery_theme parameter
Review and restrict Author-level user permissions where possible
Implement Content Security Policy headers to mitigate XSS impact
Consider temporarily disabling the Envira Gallery plugin until patching is complete

Patch Information

The vulnerability has been addressed in plugin versions after 1.12.3. The security fix implements proper output escaping for the justified_gallery_theme parameter. Details of the code changes can be reviewed in the WordPress Plugin Changeset Details. Additional vulnerability analysis is available from Wordfence Vulnerability Analysis.

Workarounds

Restrict Author-level access to trusted users only until the plugin is updated
Implement a Web Application Firewall (WAF) rule to filter XSS patterns in gallery parameters
Add Content Security Policy headers to prevent inline script execution as a defense-in-depth measure
Manually sanitize existing gallery entries by reviewing and cleaning the justified_gallery_theme values in the database

bash

# WordPress CLI command to check Envira Gallery plugin version
wp plugin list --name=envira-gallery-lite --fields=name,version,status

# Update Envira Gallery plugin to latest version
wp plugin update envira-gallery-lite

# Add CSP header in .htaccess as defense-in-depth
# Header set Content-Security-Policy "script-src 'self'; object-src 'none';"