CVE-2026-5361: Envira Gallery Lite XSS Vulnerability

CVE-2026-5361 Overview

CVE-2026-5361 is a Stored Cross-Site Scripting vulnerability in the Envira Gallery Lite plugin for WordPress, affecting all versions up to and including 1.12.4. The flaw resides in the plugin's REST API handling, where the sanitize_config_values() function fails to sanitize the arrows parameter. When the plugin renders this value into inline JavaScript via esc_attr(), it allows JavaScript expression injection. Authenticated attackers with Author-level access or higher can inject arbitrary scripts that execute when other users view affected pages.

Critical Impact
Authenticated attackers with Author privileges can inject persistent JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, account takeover, and arbitrary actions in the WordPress admin context.

Affected Products

WordPress Envira Gallery Lite plugin versions ≤ 1.12.4
WordPress sites permitting Author-level (or higher) user registrations
Any site exposing the plugin's REST API endpoints

Discovery Timeline

2026-05-14 - CVE-2026-5361 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-5361

Vulnerability Analysis

The vulnerability is a Stored Cross-Site Scripting flaw [CWE-79] in the Envira Gallery Lite plugin. The update_gallery_data() function processes incoming REST API payloads and delegates sanitization to sanitize_config_values(). That helper only sanitizes the justified_gallery_theme and justified_row_height parameters. The arrows parameter passes through unchanged.

When the gallery is rendered, gallery_init() emits the stored arrows value inside an inline JavaScript configuration block. The plugin escapes the value using esc_attr(), which is designed for HTML attribute contexts and not for JavaScript string or expression contexts. This mismatch lets attacker-controlled input break out of the intended JavaScript token and execute arbitrary code.

Exploitation requires authenticated access at the Author role or above. The injected payload persists in the gallery configuration and runs whenever the page is loaded by another user, including administrators. Because the script executes in the context of the WordPress site origin, it can perform privileged actions as the viewing user.

Root Cause

The root cause is incorrect context-aware output encoding combined with incomplete input sanitization. The plugin uses esc_attr() for output that lands in a JavaScript context, and the sanitization allowlist omits the arrows parameter entirely. See the affected source in rest.php#L163 and shortcode.php#L1067.

Attack Vector

An attacker authenticates to the target WordPress site with at least Author privileges. They send a crafted REST API request to the gallery update endpoint with a malicious arrows value containing a JavaScript expression. The value is stored in the gallery configuration. When any user visits a page containing the gallery, gallery_init() emits the unsanitized value into an inline <script> block and the payload executes in the visitor's browser.

The vulnerability mechanism is described in prose only; see the Wordfence Vulnerability Report and the upstream Envira Gallery Changeset for the corrective patch.

Detection Methods for CVE-2026-5361

Indicators of Compromise

Gallery configuration records containing JavaScript syntax such as function calls, event handlers, or eval-style expressions in the arrows field.
Unexpected outbound requests from administrator browsers immediately after viewing pages that embed an Envira gallery.
New or modified WordPress users, plugin installs, or option changes correlated with Author-level account activity.
Inline <script> blocks emitted by gallery_init() containing tokens that do not match the expected boolean or enumerated values.

Detection Strategies

Audit the WordPress database for gallery configurations and search the serialized arrows value for non-alphanumeric content.
Inspect REST API access logs for POST and PUT requests to Envira Gallery endpoints originating from Author-level accounts.
Compare rendered HTML of gallery pages against a known-good baseline to flag unexpected script content.
Monitor for HTTP requests to the affected endpoints documented in rest.php#L163.

Monitoring Recommendations

Forward WordPress access logs, REST API logs, and wp_options/postmeta change events to a centralized log platform for correlation.
Alert on creation or modification of gallery records by non-administrator roles.
Track plugin version inventory across all WordPress sites and flag instances still on 1.12.4 or earlier.

How to Mitigate CVE-2026-5361

Immediate Actions Required

Update Envira Gallery Lite to the version released after 1.12.4 that contains the fix in the referenced changeset 3514026.
Review all existing gallery configurations and remove any arrows values containing JavaScript content.
Audit Author-level and higher accounts for unexpected creations, password changes, or suspicious activity.
Force a password reset for editor and administrator accounts that viewed attacker-controlled gallery pages.

Patch Information

The vendor addressed the issue in the changeset linked above, which corrects sanitization in sanitize_config_values() and the output handling in gallery_init(). Site operators should upgrade to the latest Envira Gallery Lite release available from the WordPress plugin repository. Reference details are available in the Wordfence advisory.

Workarounds

Temporarily disable the Envira Gallery Lite plugin until the patched version is deployed.
Restrict the Author role to trusted users and avoid granting new Author accounts on public registration forms.
Deploy a Web Application Firewall rule that blocks JavaScript syntax in REST API parameters targeting Envira Gallery endpoints.
Apply Content Security Policy headers that disallow inline script execution to limit XSS impact.

bash

# Configuration example: update the plugin via WP-CLI
wp plugin update envira-gallery-lite
wp plugin get envira-gallery-lite --field=version