The Envira Gallery WordPress plugin fails to sanitize the gallery item identifier before placing it in an image tag attribute. A user with the Author role or higher can inject arbitrary JavaScript into that identifier. When any visitor opens a page that includes the gallery, the injected script executes in the visitor’s browser. This client‑side execution can potentially enable cookie theft, page hijacking, or other malicious actions, but the impact is limited to the victim’s browser without direct server access.

WordPress sites that use the Envira Gallery plugin in any version before 1.16.1. A user with the Author role or higher must create or edit a gallery containing the displaying the gallery will be affected.

The flaw carries a medium severity score of 6.8 according to CVSS. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed active exploitation reports. The likely attack vector requires a legitimate user with the Author role to inject content, after which every visitor to the gallery will be affected. The broad deployment of the plugin across WordPress sites means potential risk remains considerable, even though exploitation probability is uncertain.