CVE-2026-3423: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More

CVE-2026-3423 describes a stored cross-site scripting vulnerability in the Envira Gallery WordPress plugin, affecting all versions up to and including 1.12.4. The flaw exists in the 'description' field of galleries, where input is not properly sanitized or escaped, allowing authenticated users with Author-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of any user viewing the gallery page with the description enabled, potentially leading to session hijacking or other client-side attacks. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with Author-level access or higher can inject persistent malicious scripts into gallery descriptions. These scripts execute in the browsers of users who view the affected gallery pages, potentially compromising user sessions or performing unauthorized actions within the context of the victim's browser. The impact is limited to confidentiality and integrity of client-side data; availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and consider disabling gallery descriptions if feasible to reduce exposure.