CVE-2026-4766: Easy Image Gallery WordPress XSS Flaw

CVE-2026-4766 Overview

CVE-2026-4766 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Easy Image Gallery plugin for WordPress. The flaw exists in all versions up to and including 1.5.3. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript through the Gallery shortcode post meta field. The injected scripts execute in the browser of any user who views the affected page. The root cause is insufficient input sanitization and output escaping on user-supplied gallery shortcode values, classified under [CWE-79].

Critical Impact
Authenticated contributors can store malicious JavaScript in WordPress posts, enabling session theft, administrative account takeover, and unauthorized actions against any visitor rendering the gallery.

Affected Products

Easy Image Gallery plugin for WordPress, versions up to and including 1.5.3
WordPress sites that allow Contributor-level user registration with the plugin active
Multisite WordPress installations using the Easy Image Gallery plugin

Discovery Timeline

2026-03-25 - CVE-2026-4766 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-4766

Vulnerability Analysis

The vulnerability resides in the Easy Image Gallery plugin's handling of the gallery shortcode post meta field. The plugin reads attacker-controlled values from post metadata and renders them into page HTML without applying proper escaping functions such as esc_attr() or esc_html(). When a contributor edits or submits a post containing the gallery shortcode, the supplied parameters are persisted to the database. Any subsequent page load that renders the gallery executes the injected payload in the visitor's browser context. Because the attack is stored, a single injection can affect every visitor to the page, including administrators. The scope changes from the vulnerable component to the affected user's browser session, which increases impact across confidentiality and integrity boundaries.

Root Cause

The defect is in includes/template-functions.php near line 240, where shortcode attribute values are emitted into HTML output without sufficient sanitization. The plugin trusts post meta values that were populated by Contributor-level users, who in WordPress are not permitted to publish unfiltered HTML. The plugin neither sanitizes input on save nor escapes output on render. This double failure is the canonical pattern for stored XSS in WordPress plugins.

Attack Vector

An attacker first obtains a Contributor account through self-registration or social engineering. The attacker then creates a draft post containing the Easy Image Gallery shortcode with malicious attribute values, for example crafted parameters that close the existing HTML attribute and inject a <script> tag or an onerror handler. The contributor submits the post for review. When an editor previews the draft, or once the post is published, the payload executes in the reviewer's or visitor's browser. The payload can exfiltrate session cookies, perform CSRF actions against /wp-admin, create new administrator accounts, or plant additional persistence.

No verified public proof-of-concept code is published. Refer to the Wordfence Vulnerability Analysis and the Easy Image Gallery template source on plugins.trac.wordpress.org for the vulnerable code path.

Detection Methods for CVE-2026-4766

Indicators of Compromise

Post meta entries associated with the Easy Image Gallery plugin that contain <script>, javascript:, onerror=, onload=, or HTML attribute-breaking characters such as unescaped quotes
New administrator or editor accounts created shortly after a Contributor submitted or edited a post containing a gallery shortcode
Outbound requests from administrator browsers to attacker-controlled domains following access to posts that render Easy Image Gallery output
Unexpected modifications to WordPress options, theme files, or plugin files following Contributor activity

Detection Strategies

Query the wp_postmeta table for rows tied to gallery shortcodes and grep for HTML tags or JavaScript event handlers in the meta_value field
Inspect rendered HTML of posts that use the [easy_image_gallery] shortcode for content not produced by the plugin
Enable WordPress audit logging to capture post creation, post meta updates, and user role changes by Contributor accounts
Correlate web server access logs with admin-area requests originating from sessions that just viewed a gallery-bearing post

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and alert on Contributor-authored posts that include HTML control characters in shortcode attributes
Monitor for the creation of new privileged users and for changes to siteurl, home, or active_plugins options
Deploy a web application firewall with rules that block script payloads in POST parameters targeting /wp-admin/post.php and /wp-admin/admin-ajax.php

How to Mitigate CVE-2026-4766

Immediate Actions Required

Update the Easy Image Gallery plugin to a version newer than 1.5.3 as soon as the vendor publishes a fixed release
Audit existing posts and post meta for stored payloads in gallery shortcode attributes and remove any malicious content
Review the WordPress user list and revoke or downgrade unfamiliar Contributor, Author, Editor, or Administrator accounts
Rotate administrator passwords and invalidate active sessions using a session management plugin or by changing authentication salts in wp-config.php

Patch Information

At the time of NVD publication, no patched version is listed in the available references. Site operators should monitor the Wordfence advisory and the Easy Image Gallery WordPress.org page for an updated release that adds wp_kses_post() or equivalent escaping to the shortcode renderer at includes/template-functions.php line 240.

Workarounds

Deactivate and uninstall the Easy Image Gallery plugin until a patched version is available
Restrict Contributor account creation by disabling public registration in Settings, General, Membership
Deploy a WordPress-aware web application firewall to filter shortcode attribute payloads containing script tags or event handlers
Apply the principle of least privilege and require trusted users to be promoted only after content review

bash

# Disable public user registration via WP-CLI
wp option update users_can_register 0

# Deactivate the vulnerable plugin until a fix ships
wp plugin deactivate easy-image-gallery

# List recently created users to spot suspicious accounts
wp user list --orderby=registered --order=DESC --fields=ID,user_login,user_registered,roles