CVE-2026-3423: Envira Gallery WordPress Plugin XSS Vulnerability

CVE-2026-3423 Overview

CVE-2026-3423 is a Stored Cross-Site Scripting (XSS) vulnerability in the Envira Gallery plugin for WordPress. The flaw affects all versions up to and including 1.12.4. It stems from insufficient input sanitization and output escaping on the gallery description configuration field. Authenticated attackers with Author-level access or above can inject arbitrary JavaScript that executes whenever a visitor loads a page displaying a gallery with descriptions enabled. The vulnerability is tracked as [CWE-79] and requires network access with low privileges. Exploitation impacts both confidentiality and integrity of user sessions and can be used to pivot toward higher-privilege accounts.

Critical Impact
Authenticated Author-level users can inject persistent JavaScript that executes in the browser of any visitor viewing an affected gallery page, enabling session theft, defacement, and administrator account takeover chains.

Affected Products

Envira Gallery plugin for WordPress (all versions up to and including 1.12.4)
Envira Gallery Lite (source references indicate the same shortcode and REST code paths)
WordPress sites permitting Author-level or higher accounts to create galleries

Discovery Timeline

2026-08-28 - CVE-2026-3423 published to the National Vulnerability Database
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-3423

Vulnerability Analysis

The vulnerability is a stored (persistent) XSS in the Envira Gallery plugin. The gallery description configuration field accepts attacker-controlled input and stores it in the WordPress database. When a page containing the gallery shortcode is rendered, the description is emitted into the HTML response without adequate escaping. Any authenticated user with permission to create or edit galleries — Author role or higher — can plant a payload. Because the payload is stored, every subsequent visitor to a page that displays the gallery with descriptions enabled will execute the attacker's JavaScript in their session context. The scope change reflected in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component, including administrator-authenticated sessions elsewhere in the WordPress admin.

Root Cause

The root cause is missing or insufficient input sanitization on write and missing output escaping on read. The plugin does not apply strict allow-list filtering (for example, wp_kses with a constrained schema) to the description field on save. On render, the shortcode handler outputs the stored value into HTML without functions such as esc_html, esc_attr, or wp_kses_post. The relevant code paths are documented in includes/global/rest.php (lines 192 and 239) and includes/global/shortcode.php (line 807). Fix commits are visible in WordPress Envira Gallery Changeset 3514026.

Attack Vector

An attacker authenticates to WordPress with an Author-level (or higher) account. They create or edit a gallery and place a JavaScript payload inside the gallery description configuration field via the plugin UI or the REST API endpoints referenced in rest.php. The payload is persisted. When any user — including administrators — later loads a public or admin page that renders the gallery shortcode with description output enabled, the browser executes the stored script. Consequences include session cookie theft, forced administrative actions via authenticated requests, credential harvesting, and drive-by redirection. See the Wordfence Vulnerability Analysis for additional detail.

// No verified proof-of-concept code is published. See the vendor changeset
// and Wordfence analysis linked in this article for the vulnerable code paths
// in rest.php (lines 192, 239) and shortcode.php (line 807).

Detection Methods for CVE-2026-3423

Indicators of Compromise

Gallery description field values containing <script>, onerror=, onload=, javascript:, or encoded variants such as <script.
Unexpected outbound HTTP requests from browsers loading gallery pages, particularly to unfamiliar domains referenced from injected scripts.
New administrator accounts, altered user roles, or unexpected plugin/theme installations following visits to pages hosting galleries.

Detection Strategies

Query the wp_postmeta table for Envira Gallery configuration entries and inspect the description field for HTML event handlers or <script> tags.
Review web server access logs for POST and PUT requests to Envira REST routes originating from Author-level accounts.
Monitor Content Security Policy (CSP) violation reports for inline script executions on pages that render gallery shortcodes.

Monitoring Recommendations

Alert on modifications to gallery posts by non-Editor, non-Administrator accounts.
Enable and centralize WordPress audit logs to capture gallery create/update events with the acting user, IP, and payload size.
Track anomalous session activity — such as administrator sessions being used from new IP addresses shortly after gallery page visits.

How to Mitigate CVE-2026-3423

Immediate Actions Required

Update the Envira Gallery plugin to the version released after 1.12.4 that includes the fix from changeset 3514026.
Audit all existing galleries and remove any description values containing HTML or JavaScript that was not authored by trusted staff.
Rotate session cookies and force re-authentication for administrator accounts if exploitation is suspected.

Patch Information

The vendor addressed the issue in the shortcode handler by adding proper output escaping. Refer to the WordPress.org plugin repository changeset for the exact code delta: Envira Gallery Changeset 3514026. Additional analysis is available in the Wordfence advisory.

Workarounds

Restrict gallery creation and editing to Editor or Administrator roles until the patched version is installed.
Deploy a Web Application Firewall (WAF) rule that blocks HTML tags and event handler attributes in Envira REST request bodies targeting the description field.
Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to reduce the impact of stored payloads.
Temporarily disable gallery descriptions on public pages by editing the shortcode configuration.

bash

# Example: WP-CLI check for suspicious payloads in Envira gallery descriptions
wp db query "SELECT post_id, meta_key, meta_value \
  FROM wp_postmeta \
  WHERE meta_key LIKE '_eg_%' \
  AND (meta_value LIKE '%<script%' \
       OR meta_value LIKE '%onerror=%' \
       OR meta_value LIKE '%javascript:%');"

# Update the plugin once a fixed release is available
wp plugin update envira-gallery-lite