CVE-2026-104653

Name of the Vulnerable Software and Affected Versions Envira Gallery WordPress plugin versions prior to 1.16.1

Description Insufficient sanitization and escaping of user-supplied gallery display configuration values before they are stored and outputted in an image tag attribute. This allows users with the Author role and above to perform a Cross-Site Scripting (XSS) attack—a technique where malicious scripts are injected into trusted websites—which execute when any visitor, including an administrator, views a page containing the affected gallery.

Recommendations Update the Envira Gallery WordPress plugin to version 1.16.1 or later.