EUVD-2026-94179
GHSA-8g3x-h6fx-23x5
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author is a low-privilege authenticated role (PR:L, not PR:H); a victim must view the gallery (UI:R); stored script executes in another user's context (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
AnalysisAI
Stored cross-site scripting (XSS) in Envira Gallery WordPress plugin before 1.16.1 allows an authenticated user with Author role or higher to store a malicious gallery item identifier that is output unsanitized in an image tag attribute, causing script execution when any visitor, including an administrator, views a page embedding the gallery. Publicly available exploit code exists for this issue, but it is not listed in CISA KEV in the provided data; the vendor has released a patch in version 1.16.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with the WordPress 'Author' role or higher on the target site (not anonymous access), plus the ability to create or edit a gallery so that the attacker-controlled gallery item identifier is stored. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Envira Gallery WordPress plugin, rated CVSS 6.8 (Medium) in the input. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Envira Gallery to version 1.16.1 or later; this is the vendor-released patch and the version boundary in the affected-version data, and it addresses the stored XSS by sanitizing and escaping the gallery item identifier. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Envira Gallery
View allAuthenticated stored cross-site scripting in the Envira Gallery WordPress plugin before 1.16.1 allows users with Author
The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outp
Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured
The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings,
A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Rated medium severity
The Gallery Plugin for WordPress - Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today