CVE-2026-5743 is a stored cross-site scripting vulnerability in the SimpLy Gallery Block & Lightbox WordPress plugin (gallerycreator). The vulnerability is due to insufficient input sanitization and output escaping on the sliderMaxHeight block attribute within the pgc_sgb_render_callback() function. The pgc_sgb_sanitize_custom_css() function uses a flawed regex that only removes event handlers with quoted values but fails to catch unquoted event handlers, allowing malicious script injection. Authenticated attackers with Author-level privileges or higher can exploit this to inject arbitrary web scripts that execute when users access the injected page. This affects all versions up to and including 3.3.3.2.

An attacker with Author-level access or higher can inject persistent malicious scripts into pages via block attributes. These scripts execute in the context of users visiting the affected pages, potentially leading to information disclosure (e.g., cookie theft) and other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Author-level access to trusted users only and consider disabling or removing the SimpLy Gallery plugin if possible. Monitor for updates from the vendor or plugin maintainers to apply an official fix once released.