CVE-2026-104653
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied…
- Risk score
- 44/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an a…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.16.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
Last activity 7 Oct 2026. Patch Forecast updates every hour.