CVE-2026-3423: Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the gallery with a description enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Envira Gallery (WordPress plugin)to a version that resolves this vulnerability.Fixed in 1.12.4 - Configuration
Update the Envira Gallery plugin to the fixed version that addresses Stored XSS in the gallery 'description' field (described as affected through 1.12.4). After updating, verify that the gallery description is properly sanitized and output-escaped when description display is enabled.
Envira Gallery (WordPress plugin) gallery description output escaping/sanitization (description configuration field) = Apply vendor fix to sanitize/escape the gallery 'description' configuration field before rendering
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with an Author role or higher can exploit it. The attacker must be able to edit a gallery description.
When does the injected script execute?
The script executes when a user visits a page that displays the affected gallery and has its description enabled. This can affect visitors or other logged-in users who view that page.
Which versions are affected?
Envira Gallery versions up to and including 1.12.4 are affected.