PT-2026-22884

CVE-2026-1236

Published

2026-03-03

Updated

2026-03-05

Description by

CVSS 3.1

6.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Envira Gallery for WordPress plugin versions up to and including 1.12.3

Description The Envira Gallery for WordPress plugin is susceptible to Stored Cross-Site Scripting through the justified gallery theme parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page.

Recommendations Update Envira Gallery for WordPress plugin to a version later than 1.12.3

Exploitability

Fix

Impacts

Researchers

Athiwat Tiprasaharn

Itthidej Aramsri

Waris Damkham

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')