The Envira Gallery Lite plugin for WordPress suffers from a stored XSS vulnerability due to inadequate sanitization of the 'arrows' parameter in the update_gallery_data() function and improper escaping in the gallery_init() function. While some parameters are sanitized, the 'arrows' parameter is not, and its value is output in inline JavaScript using esc_attr(), which is insufficient for JavaScript contexts. This allows authenticated attackers with Author-level privileges or higher to inject malicious scripts via the REST API, which execute when users access the injected gallery pages.

An attacker with Author-level or higher privileges can inject arbitrary JavaScript code into gallery pages, potentially leading to session hijacking, defacement, or other malicious actions executed in the context of users viewing the compromised pages. The vulnerability does not affect availability but impacts confidentiality and integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only to reduce risk. Avoid exposing the vulnerable plugin on publicly accessible sites or disable the plugin if possible. Monitor for vendor updates regarding patches or official mitigations.