CVE-2026-4085 is a stored cross-site scripting vulnerability in the Easy Social Photos Gallery WordPress plugin (up to version 3.1.2). The issue is due to the plugin using sanitize_text_field() rather than esc_attr() when outputting the 'wrapper_class' attribute inside a double-quoted HTML class attribute. Since sanitize_text_field() does not encode double quotes, an attacker with contributor-level privileges can break out of the class attribute context and inject arbitrary HTML event handlers or scripts. This results in script execution in the context of users visiting the injected page.

An authenticated attacker with contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts into pages. These scripts execute in the context of users who view the compromised pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Easy Social Photos Gallery plugin if possible. Monitor for vendor updates regarding a patch or official remediation.