Gallery Custom Links CVE-2026-107757

Exploitation requires an authenticated account with at least subscriber-level privileges on the target site (PR:L) and the plugin's default-on output-buffering/page-rewrite feature being active (which it is by default per the description). The attacker must supply two coordinated inputs: an HTML-comment payload stored verbatim in a comment body (preserved by WordPress comment kses) AND a matching simple_html_dom 'noise key' placed in the attacker's profile display_name, which survives esc_attr(); substitution only occurs after both filters run during the plugin's buffering pass over the rendered page. Limiting factors: authentication is mandatory, the dual-input coordination raises attack complexity (AC:H), and the payload only fires when another user accesses the injected page. These conditions make exploitation deliberate and targeted rather than opportunistic or automatable.

This is a genuinely low-priority issue despite the CRITICAL CWE class (CWE-79 Stored XSS). The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N, base 4.9 Medium) is internally consistent with the description and understates nothing: exploitation is network-reachable but requires authentication (PR:L, subscriber-level) and has high attack complexity (AC:H), which is well justified because the description requires two coordinated, precisely-crafted inputs from the same attacker (an HTML-comment payload in a comment body plus a matching simple_html_dom noise key in display_name) that must survive two separate WordPress filters and then be recombined during the plugin's output-buffering pass. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code is referenced - so no exploitation-probability signal elevates this above its base score. The SSVC framework is not supplied in the input. The signals are mutually consistent rather than conflicting: a Medium-severity, high-complexity, authenticated stored XSS reported by Wordfence with a vendor patch (changeset 3737485) available. The only mild caveat is that 'subscriber-level and above' plus the contrived two-input mechanism means real-world exploitation is unlikely to be opportunistic or automatable.

An attacker who has registered a subscriber account on a WordPress site running Gallery Custom Links (≤2.3.3) posts a comment containing an HTML-comment payload and sets their profile display_name to a matching simple_html_dom noise key. When the plugin's default output-buffering pass rewrites the fully rendered page, the two fragments are recombined into executable script that runs in the browser of any user who views the affected page. No public exploit code is identified at time of analysis, and the two-input coordination plus AC:H make this a deliberate, non-trivial attack rather than a drive-by.