Envira Gallery EUVD-2026-67708

Exploitation requires an active WordPress account with at minimum the Author role on the target WordPress installation - Editor, Administrator, and Super Admin roles are also sufficient. The target gallery must have a description field populated with attacker-controlled content, and at least one WordPress page or post must render that gallery with description display enabled via shortcode or block. The attack is limited to: (1) sites where untrusted or semi-trusted parties hold Author-level or higher WordPress roles; (2) galleries that have descriptions rendered on front-end pages accessible to other users. Sites where all Author-level and above accounts belong exclusively to trusted individuals face no realistic threat from external attackers. The CVSS PR:L confirms authenticated access is mandatory - unauthenticated exploitation is not possible.

The CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) is accurately representative. The Scope:Changed metric is the critical signal here - the attacker's payload crosses from the WordPress admin/editor context into arbitrary site visitors' browser sessions, enabling impacts beyond the attacker's own privilege level, including potential admin session hijacking if an administrator views the affected gallery. Attack Complexity:Low and User Interaction:None reflect that stored XSS fires passively on page load without requiring the victim to take a specific action. The primary limiting factor is PR:L - at minimum an Author-level WordPress account is required, which meaningfully constrains opportunistic exploitation to sites that grant this role to untrusted or semi-trusted users. No EPSS score was provided in source data, and the vulnerability is not listed in CISA KEV, so no confirmed active exploitation signal exists. Real-world priority should be elevated for multi-author WordPress sites (news, agencies, SaaS) where Author accounts may be held by external contributors, and deprioritized for single-author or tightly controlled installations.

An attacker obtains or already holds a WordPress Author account on the target site - for example, through credential stuffing, a compromised contributor account, or a site that allows open registration with Author privileges. The attacker edits a gallery's description field, inserting a JavaScript payload such as a cookie-stealing script pointing to an attacker-controlled endpoint. When a site administrator or any logged-in user subsequently browses a page displaying that gallery, the script silently transmits their session cookie to the attacker, who can then replay it to gain full admin access to the WordPress installation.