The Envira Gallery Lite plugin for WordPress contains insufficient input sanitization in the update_gallery_data() function and improper output escaping in gallery_init(). The plugin sanitizes only a subset of parameters and then outputs the 'arrows' value into inline JavaScript using esc_attr(), which is inappropriate for JavaScript contexts. This flaw allows authenticated users with Author privileges or higher to inject arbitrary JavaScript code that will execute whenever any visitor loads a page containing the injected gallery configuration, potentially stealing session data or defacing content.

WordPress installations using Envira Gallery Lite version 1.12.4 or earlier. The vulnerability is triggered through the plugin’s REST API endpoint and requires that an account with Author role or higher exists on the site.

The CVSS score of 6.4 places the flaw in the moderate range, and the EPSS score is currently unavailable; it is not listed in the CISA KEV catalog. Attackers can exploit the weakness by submitting a crafted REST request to update_gallery_data() from a privileged account. Once the malicious script is stored in the gallery configuration, it will be executed in the context of any visitor who loads the gallery page, leading to significant confidentiality and integrity risks. The likelihood of exploitation is elevated because the plugin is widely used and the REST endpoint is exposed publicly on sites that enable REST API access.