CVE-2026-5743

Name of the Vulnerable Software and Affected Versions SimpLy Gallery Block & Lightbox versions prior to 3.3.3.3

Description Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping of the sliderMaxHeight block attribute within the pgc sgb render callback() function. The issue stems from a flawed regex pattern in the pgc sgb sanitize custom css() function that removes event handlers with quoted values but fails to detect unquoted event handlers, allowing malicious code to bypass sanitization. Authenticated attackers with Author-level access or higher can inject arbitrary web scripts into pages via block attributes, which execute when a user visits the affected page.

Recommendations Update to a version newer than 3.3.3.2. As a temporary workaround, restrict Author-level access to modify block attributes until the update is applied.