CVE-2026-5191

Tiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'

View on CVE.org
Published Jun 2, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
The Tiled Gallery Carousel Without JetPack plugin for WordPress is vulnerable to stored cross-site scripting via the 'data-image-title' parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

AI-generated

Technical impact

The Tiled Gallery Carousel Without JetPack plugin contains a stored cross‑site scripting flaw that occurs when the data‑image-title attribute is not sanitized. An authenticated user with contributor privilege can supply a malicious value that will be stored and later rendered without escaping, allowing client‑side code execution on any visitor that opens the gallery.

Affected Systems

All installations of Raja3c’s Tiled Gallery Carousel Without JetPack plugin version 3.1 or earlier are vulnerable. The flaw is independent of the underlying WordPress core version and will affect any WordPress site that hosts the vulnerable plugin.

Risk and Exploitability

The CVSS score of 5.4 indicates medium severity. EPSS is not available, and the flaw is not listed in CISA KEV. Attack requires authenticated contributor or higher access; the malicious payload is stored in the plugin’s database and rendered unescaped when a gallery page is displayed. Any user who visits the infected page will execute the injected script, creating a client‑side code execution channel that could be used for session hijacking, defacement, or phishing.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Tiled Gallery Carousel Without JetPack plugin to a version newer than 3.1
  • If upgrading is not feasible, enforce strict input validation for the data-image-title parameter, ensuring it is properly escaped before rendering
  • Restrict contributor‑level access or review contributor permissions to reduce the risk of malicious script injection

Generated by OpenCVE AI on June 2, 2026 at 11:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Raja3c
Raja3c tiled Gallery Carousel Without Jetpack
Wordpress
Wordpress wordpress
Vendors & Products Raja3c
Raja3c tiled Gallery Carousel Without Jetpack
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The Tiled Gallery Carousel Without JetPack plugin for WordPress is vulnerable to stored cross-site scripting via the 'data-image-title' parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Tiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
Jun 2, 2026, 10:43 AM
Reserved
Mar 30, 2026, 8:59 PM

View source JSON

Updated
Jun 2, 2026, 10:43 AM

JSON

Status
Deferred
Published
Jun 2, 2026, 10:16 AM
Modified
Jul 22, 2026, 7:10 PM

View source JSON

No data.

Updated
Jun 2, 2026, 8:51 PM

JSON