EUVD-2026-94180
GHSA-2475-cpcf-ghxx
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author role maps to PR:L not PR:H; script runs in a different context (S:C) with typical stored-XSS Low C/I and no availability impact; victim page view gives UI:R.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
AnalysisAI
Authenticated stored cross-site scripting in the Envira Gallery WordPress plugin before 1.16.1 allows users with Author role or higher to inject arbitrary web scripts through unsanitized gallery display configuration values, which are stored and later rendered into an image tag attribute. The injected script executes when any visitor, including an administrator, views a page containing the affected gallery; exploitation requires an authenticated low-privilege account and a victim page view. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account with the Author role or higher on a site running Envira Gallery before 1.16.1; the attacker must create or edit a gallery and place a payload in a gallery display-configuration value that is rendered into an image tag attribute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is an authenticated stored Cross-Site Scripting flaw (CWE-79) in the Envira Gallery WordPress plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Envira Gallery to version 1.16.1 or later (Vendor-released patch: 1.16.1) and verify the plugin version in WordPress. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Envira Gallery
View allStored cross-site scripting (XSS) in Envira Gallery WordPress plugin before 1.16.1 allows an authenticated user with Aut
The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outp
Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did
Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery allows Exploiting Incorrectly Configured
The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings,
A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Rated medium severity
The Gallery Plugin for WordPress - Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today