PT-2026-27635

CVE-2026-4766

Publicado

2026-03-20

Atualizado

2026-04-04

Descrição por

CVSS 3.1

6.4

Média

MétricasAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy Image Gallery versions prior to 1.5.4

Description The Easy Image Gallery plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Gallery shortcode post meta field. Insufficient input sanitization and output escaping of user-supplied gallery shortcode values allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

Recommendations Update Easy Image Gallery to version 1.5.4 or later.

Explorabilidade

Correção

Impactos

Pesquisadores

Athiwat Tiprasaharn

Itthidej Aramsri

Waris Damkham

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')