PT-2026-27635

CVE-2026-4766

Published

2026-03-20

Updated

2026-04-04

Description by

CVSS 3.1

6.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy Image Gallery versions prior to 1.5.4

Description The Easy Image Gallery plugin for WordPress is susceptible to Stored Cross-Site Scripting through the Gallery shortcode post meta field. Insufficient input sanitization and output escaping of user-supplied gallery shortcode values allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the affected page.

Recommendations Update Easy Image Gallery to version 1.5.4 or later.

Exploitability

Fix

Impacts

Researchers

Athiwat Tiprasaharn

Itthidej Aramsri

Waris Damkham

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')