CVE-2026-1302: Meta-box GalleryMeta XSS Vulnerability

CVE-2026-1302 Overview

The Meta-box GalleryMeta plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via admin settings in all versions up to, and including, 3.0.1. The vulnerability arises due to insufficient input sanitization and output escaping in the plugin's administrative interface. This allows authenticated attackers with editor-level permissions or above to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the browsers of any user viewing affected pages, potentially leading to session hijacking, credential theft, or administrative account compromise on WordPress multi-site installations.

Affected Products

• Meta-box GalleryMeta WordPress plugin versions up to and including 3.0.1
• WordPress multi-site installations with the plugin enabled
• WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

• 2026-01-24 - CVE CVE-2026-1302 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-1302

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the Meta-box GalleryMeta plugin's administrative settings handling. The root issue stems from the plugin's failure to properly sanitize user-supplied input and escape output when rendering content in the admin interface and front-end templates.

When an authenticated user with editor-level privileges or higher saves settings through the plugin's admin interface, the input values are stored in the database without adequate sanitization. Subsequently, when these values are rendered on pages—either in the admin dashboard or on public-facing gallery pages—the lack of proper output escaping allows the injected scripts to execute in the context of the viewing user's browser session.

The vulnerability specifically affects WordPress multi-site installations and single-site installations where the unfiltered_html capability has been disabled. This is notable because in standard WordPress single-site installations, users with editor privileges and above typically already have unfiltered_html capability, which allows them to post unfiltered HTML content by design. However, in multi-site environments and configurations where this capability is restricted, this plugin vulnerability provides an unintended bypass.

Root Cause

The vulnerability is caused by insufficient input sanitization and output escaping in the plugin's settings handling code. Specifically, the affected code paths in gallerymetaboxes.php (lines 119 and 314) and the template files single-mb_gallery.php (lines 31 and 33) fail to apply WordPress sanitization functions such as sanitize_text_field(), esc_html(), or esc_attr() when processing and displaying user-controlled data. This allows HTML and JavaScript content to be stored and later rendered without modification, enabling script injection attacks.

Attack Vector

An attacker requires authenticated access to the WordPress installation with at least editor-level permissions. The attack is executed over the network by:

1. Authenticating to the WordPress admin panel with editor or higher privileges
2. Navigating to the Meta-box GalleryMeta plugin settings
3. Injecting malicious JavaScript code into vulnerable input fields
4. Saving the configuration, which stores the payload in the database
5. The malicious script executes when any user (including administrators) views pages containing the injected content

The attack has a changed scope, meaning the malicious script can potentially impact users and sessions beyond the vulnerable component itself. While the complexity is considered high due to the specific conditions required (multi-site or disabled unfiltered_html), successful exploitation can result in session hijacking, privilege escalation, or further compromise of the WordPress installation.

For technical implementation details, refer to the WordPress Plugin Code Snippets and Template Code in the WordPress plugin repository.

Detection Methods for CVE-2026-1302

Indicators of Compromise

• Presence of <script> tags, event handlers (e.g., onerror, onload), or encoded JavaScript within Meta-box GalleryMeta plugin settings stored in the WordPress database
• Unexpected JavaScript execution or browser alerts when viewing gallery pages
• Suspicious entries in WordPress plugin settings containing HTML entities or JavaScript code
• Unexplained administrator session activity or privilege changes following gallery page views

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common XSS payload patterns in POST requests to WordPress admin endpoints
• Deploy browser-based Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Use WordPress security plugins that scan for stored XSS patterns in database content and plugin settings
• Monitor server access logs for unusual patterns of settings changes followed by page requests

Monitoring Recommendations

• Enable and review WordPress audit logging for all plugin settings modifications
• Configure CSP reporting to capture attempted script injection violations
• Implement file integrity monitoring on plugin files to detect unauthorized modifications
• Monitor for anomalous user session patterns that may indicate session hijacking following XSS exploitation

How to Mitigate CVE-2026-1302

Immediate Actions Required

• Review and audit all Meta-box GalleryMeta plugin settings for suspicious content or embedded scripts
• Restrict editor-level access to trusted users only until the plugin is updated or removed
• Consider temporarily deactivating the Meta-box GalleryMeta plugin on multi-site installations until a patched version is available
• Implement Content Security Policy headers to mitigate the impact of any stored XSS payloads

Patch Information

Organizations using the Meta-box GalleryMeta plugin should monitor the WordPress plugin repository for security updates that address this vulnerability. Review the Wordfence Vulnerability Report for the latest remediation guidance and update announcements. Until a patch is available, consider the workarounds below.

Workarounds

• Disable or uninstall the Meta-box GalleryMeta plugin if gallery functionality is not critical to operations
• Implement strict Content Security Policy headers to prevent inline script execution site-wide
• Restrict plugin settings access by modifying user roles to remove editor-level access to plugin configuration
• Use a Web Application Firewall (WAF) with XSS filtering rules to block malicious payloads at the network perimeter

Content Security Policy implementation to restrict inline script execution:

# Apache .htaccess configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"