CVE-2026-104653: Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions

Q: Who can exploit this issue, and who is affected when it is triggered?

A user with the WordPress Author role or any higher-privileged role can inject the malicious configuration value. The script executes for any visitor who views a page containing the affected gallery, including administrators.

Q: What does an attacker need to do to trigger the stored script execution?

The attacker needs the ability to supply gallery display configuration values, specifically the gallery crop dimensions, and have a page containing that gallery viewed by another user. The vulnerable plugin stores the supplied value and later outputs it in an image tag attribute.

Q: How can I determine whether my site is affected?

Check whether Envira Gallery is installed and running a version earlier than 1.16.1. Also review gallery crop-dimension and display configuration values for unexpected or script-like content, particularly in galleries created or modified by Author-level users.

Published Oct 7, 2026

Updated

The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.

Affected Software

1 affected component

Envira Gallery Envira Gallery<1.16.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Envira Gallery to a version that resolves this vulnerability.
Fixed in 1.16.1

Event History

Oct 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue, and who is affected when it is triggered?

A user with the WordPress Author role or any higher-privileged role can inject the malicious configuration value. The script executes for any visitor who views a page containing the affected gallery, including administrators.

What does an attacker need to do to trigger the stored script execution?

The attacker needs the ability to supply gallery display configuration values, specifically the gallery crop dimensions, and have a page containing that gallery viewed by another user. The vulnerable plugin stores the supplied value and later outputs it in an image tag attribute.

How can I determine whether my site is affected?

Check whether Envira Gallery is installed and running a version earlier than 1.16.1. Also review gallery crop-dimension and display configuration values for unexpected or script-like content, particularly in galleries created or modified by Author-level users.

CVE-2026-104653: Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue, and who is affected when it is triggered?

What does an attacker need to do to trigger the stored script execution?

How can I determine whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is affected when it is triggered?

What does an attacker need to do to trigger the stored script execution?

How can I determine whether my site is affected?