EUVD-2026-43120
GHSA-7jhf-qg59-fxm2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS payload executes only when a victim loads the injected page, requiring UI:R; all other vendor metrics are consistent with the description.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The SimpLy Gallery Block & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block attributes in all versions up to, and including, 3.3.3.2. This is due to insufficient input sanitization and output escaping on the sliderMaxHeight block attribute in the pgc_sgb_render_callback() function. The vulnerability exists because the pgc_sgb_sanitize_custom_css() function uses a flawed regex pattern that only removes event handlers with quoted values (e.g., onfocus="alert()") but fails to catch unquoted event handlers (e.g., onfocus=alert(document.cookie)), allowing the malicious code to bypass sanitization. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages via block attributes that will execute whenever a user accesses an injected page.
AnalysisAI
Stored XSS in the SimpLy Gallery Block & Lightbox WordPress plugin (all versions through 3.3.3.2) allows authenticated attackers with Author-level access to inject persistent JavaScript via the sliderMaxHeight block attribute. The root cause is a defective regex in pgc_sgb_sanitize_custom_css() that strips quoted event handlers but silently permits unquoted HTML event handler syntax (e.g., onfocus=alert(document.cookie)), enabling a sanitization bypass that survives to page render. No public exploit or CISA KEV listing is identified at time of analysis, though the stored nature means injected payloads persist and execute against any subsequent visitor - including administrators.
Technical ContextAI
The vulnerability resides in blocks/init.php of the Simply Gallery Block & Lightbox WordPress plugin (CPE: cpe:2.3:a:gallerycreator:simply_gallery:*:*:*:*:*:*:*:*), specifically within the pgc_sgb_render_callback() server-side render callback for the Gutenberg gallery block. CWE-79 (Improper Neutralization of Input During Web Page Generation) applies: the sanitization function pgc_sgb_sanitize_custom_css() implements a regex designed to strip HTML event handlers, but the pattern only matches handlers whose value is enclosed in quotes (onfocus="alert()"). Unquoted attribute syntax - valid per HTML5 parsing rules (onfocus=alert(document.cookie)) - is invisible to the regex and passes through unmodified into rendered output. This is a classic partial-sanitization flaw: the developer correctly identified the attack class but produced an incomplete strip pattern. The Gutenberg block editor serializes block attributes and passes them to the PHP render callback, making the sliderMaxHeight attribute the concrete injection vector. Affected code lines are documented in WordPress SVN at blocks/init.php lines 95, 122, 142, and 151.
RemediationAI
A fix has been committed to the plugin's WordPress SVN trunk as changeset 3581386 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3581386%40simply-gallery-block&new=3581386%40simply-gallery-block); however, the corresponding released plugin version number is not stated in available data - update to the latest version available in the WordPress plugin repository and confirm it is newer than 3.3.3.2. As an immediate workaround, administrators should audit existing posts authored by Author-level accounts for suspicious sliderMaxHeight attribute values containing unquoted event handlers (grep for patterns like onfocus= without a following quote). Restricting the Author role to only fully-trusted users eliminates the attack surface without disabling the plugin. Disabling the Simply Gallery Block plugin entirely is the most effective compensating control while awaiting patch confirmation. WAF rules targeting unquoted event handler injection in POST body parameters provide a partial defense but carry bypass risk and should not be the sole control.
More in Simply Gallery
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today