CVE-2026-5743 Overview
CVE-2026-5743 is a Stored Cross-Site Scripting (XSS) vulnerability in the SimpLy Gallery Block & Lightbox plugin for WordPress. The flaw affects all versions up to and including 3.3.3.2. The issue resides in the pgc_sgb_render_callback() function, which processes the sliderMaxHeight block attribute without sufficient input sanitization or output escaping. Authenticated attackers with Author-level access or above can inject arbitrary JavaScript that executes in the browser of any user who views an affected page. The vulnerability is classified under CWE-79.
Critical Impact
Authenticated attackers with Author privileges can inject persistent JavaScript that executes in visitors' browsers, enabling session theft, credential harvesting, and administrative account takeover.
Affected Products
- SimpLy Gallery Block & Lightbox plugin for WordPress — all versions ≤ 3.3.3.2
- WordPress sites where the plugin is installed and active
- Any site permitting Author-level or higher user registration with the plugin enabled
Discovery Timeline
- 2026-07-11 - CVE-2026-5743 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-5743
Vulnerability Analysis
The vulnerability stems from flawed regular expression logic in the pgc_sgb_sanitize_custom_css() function. This sanitization routine attempts to strip HTML event handler attributes from user-supplied CSS values before rendering them on the page. The regex pattern only matches event handlers whose values are wrapped in quotes, such as onfocus="alert()". Unquoted event handler syntax, such as onfocus=alert(document.cookie), bypasses the filter entirely and reaches the rendered output.
The sliderMaxHeight block attribute passes through this deficient sanitizer inside pgc_sgb_render_callback(). Because output escaping is also absent, the injected payload is written directly into the page HTML. Any authenticated user with Author privileges or higher can craft a Gutenberg block containing the malicious attribute value and publish it.
Root Cause
The root cause is an incomplete sanitization regex combined with missing context-aware output escaping. The regex assumes attackers will always use quoted syntax for event handlers, ignoring HTML's tolerance for unquoted attribute values. Secure practice requires escaping data at the output boundary using functions such as esc_attr() or wp_kses() with a strict allowlist rather than relying on blocklist-based regex filtering.
Attack Vector
An authenticated attacker with Author or higher role authors a post or page containing a SimpLy Gallery block. The attacker manipulates the sliderMaxHeight block attribute to include an unquoted event handler payload that carries JavaScript. When the post is published and viewed by any visitor, including administrators, the payload executes in the victim's browser context. Refer to the Wordfence Vulnerability Report and the WordPress Simply Gallery source for technical details.
Detection Methods for CVE-2026-5743
Indicators of Compromise
- Gallery block post content containing HTML event handlers such as onfocus=, onerror=, or onload= inside the sliderMaxHeight attribute.
- Unexpected <script> execution, redirects, or cookie exfiltration originating from pages containing SimpLy Gallery blocks.
- Creation or modification of posts by newly registered Author-level accounts followed by administrator visits to those pages.
Detection Strategies
- Query the WordPress wp_posts table for post content containing simply-gallery-block markup combined with on\w+= patterns not enclosed in quotes.
- Inspect stored block attributes via the REST API endpoint /wp-json/wp/v2/pages and search for suspicious values in sliderMaxHeight.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions triggered by injected handlers.
Monitoring Recommendations
- Log and alert on privilege changes and new Author-role account creation on WordPress instances.
- Monitor web server access logs for administrator sessions loading pages that contain injected event handler strings.
- Track plugin version inventory across managed WordPress fleets and flag installations of SimpLy Gallery Block & Lightbox at or below 3.3.3.2.
How to Mitigate CVE-2026-5743
Immediate Actions Required
- Update the SimpLy Gallery Block & Lightbox plugin to a version above 3.3.3.2 as soon as a patched release is available from the vendor.
- Audit existing posts and pages containing SimpLy Gallery blocks for unexpected event handler attributes and remove malicious content.
- Review Author and higher-privileged accounts, revoke unused accounts, and rotate credentials for any account suspected of compromise.
Patch Information
Refer to the WordPress Simply Gallery Change Set and the Wordfence Vulnerability Report for the current fix status and remediated version details.
Workarounds
- Deactivate the SimpLy Gallery Block & Lightbox plugin until a patched version is installed.
- Restrict user registration and limit Author-level or higher privileges to trusted administrators only.
- Deploy a Web Application Firewall (WAF) rule that blocks HTTP requests containing unquoted event handlers in block attribute payloads.
# Configuration example: disable the plugin via WP-CLI until patched
wp plugin deactivate simply-gallery-block
# Optional: enforce a strict Content Security Policy header via .htaccess
# Header set Content-Security-Policy "default-src 'self'; script-src 'self'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
