CVE-2026-5191: WordPress Tiled Gallery Plugin XSS Flaw

CVE-2026-5191 Overview

CVE-2026-5191 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting the Tiled Gallery Carousel Without JetPack plugin for WordPress. The flaw impacts all versions up to and including 3.1. It stems from insufficient input sanitization and output escaping in the data-image-title parameter. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. The injected payload executes in the browser of any visitor who accesses the affected page.

Critical Impact
Authenticated contributors can persist malicious JavaScript that executes against site visitors and administrators, enabling session theft, privilege escalation, and content tampering.

Affected Products

Tiled Gallery Carousel Without JetPack plugin for WordPress (all versions ≤ 3.1)
WordPress sites permitting contributor-level or higher accounts
Any site loading the vulnerable jetpack-carousel.js component

Discovery Timeline

2026-06-02 - CVE-2026-5191 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-5191

Vulnerability Analysis

The plugin processes image metadata supplied during gallery creation and renders it within the carousel viewer through the jetpack-carousel.js script. The data-image-title HTML attribute is read from gallery markup and inserted into the page document without adequate sanitization or output escaping. An attacker with contributor permissions can craft a gallery item whose title carries JavaScript payloads or HTML breakout sequences. When the carousel renders the gallery, the injected script executes in the visitor's browser context.

Because the payload is stored in the WordPress database, every subsequent page load triggers execution. The scope-change indicator in the CVSS vector reflects that the script executes in the security context of any user who views the page, not only the attacker.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render for the data-image-title attribute. The plugin trusts contributor-supplied metadata and writes it into DOM attributes that are later parsed as HTML by the carousel client-side code. See the WordPress Plugin Code Review for the affected source location.

Attack Vector

An authenticated attacker with a contributor account creates or edits a post containing a tiled gallery. They embed a malicious payload in the image title metadata that the plugin maps to data-image-title. After the post is published or previewed by a higher-privileged user, the carousel script renders the attribute and the payload executes. Successful exploitation can hijack administrator sessions, perform actions on behalf of authenticated users, or redirect visitors to attacker-controlled infrastructure.

No verified proof-of-concept code is published. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-5191

Indicators of Compromise

Gallery image titles containing HTML tags, <script> fragments, or event handlers such as onerror= and onload=.
Unexpected outbound requests from visitor browsers to unknown domains when carousel-enabled posts load.
New or modified posts authored by contributor accounts that include tiled galleries with abnormal metadata.
WordPress audit log entries showing contributor-tier users editing media metadata at unusual frequencies.

Detection Strategies

Inspect the wp_posts and wp_postmeta tables for data-image-title attribute values containing angle brackets, quotes, or JavaScript keywords.
Deploy a web application firewall rule that flags POST requests to wp-admin/post.php carrying script tags within gallery attachment fields.
Use browser-based content security policy (CSP) violation reports to surface inline script execution on pages containing tiled galleries.

Monitoring Recommendations

Monitor contributor and author account activity for anomalous publishing patterns or repeated media edits.
Alert on WordPress plugin version drift to identify installations still running Tiled Gallery Carousel Without JetPack 3.1 or earlier.
Track HTTP responses serving pages with the carousel for unexpected JavaScript payloads using DOM inspection during synthetic monitoring.

How to Mitigate CVE-2026-5191

Immediate Actions Required

Disable the Tiled Gallery Carousel Without JetPack plugin until a patched release is verified.
Audit all contributor-level and above accounts and revoke unused or suspicious accounts.
Review recent posts containing tiled galleries and remove any with suspicious data-image-title content.
Rotate session cookies and administrator credentials if exploitation is suspected.

Patch Information

As of the NVD publication date, no patched version is referenced. Site operators should monitor the WordPress plugin repository for a release later than 3.1 and apply it immediately when available.

Workarounds

Restrict contributor account creation and require editor review before publishing posts containing galleries.
Deploy a Content Security Policy that disallows inline scripts and unknown script sources to limit XSS impact.
Apply a WAF rule that strips HTML tags from media title fields submitted through wp-admin endpoints.
Replace the plugin with an actively maintained gallery alternative if a patch is not released promptly.

bash

# Disable the vulnerable plugin via WP-CLI until a patch is available
wp plugin deactivate tiled-gallery-carousel-without-jetpack
wp plugin status tiled-gallery-carousel-without-jetpack