Injection Flaw in Envira Gallery Plugin for WordPress
CVE-2026-104652

Currently unrated

Key Information:

Vendor

WordPress
Status
Envira Gallery
Vendor
CVE Published:
7 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-104652?

The Envira Gallery plugin for WordPress prior to version 1.16.1 is susceptible to an injection vulnerability. This issue arises because the plugin fails to properly sanitize and escape gallery item identifiers before rendering them in image tag attributes. As a result, users with the Author role or higher can embed malicious web scripts, which execute when any site visitor interacts with the affected gallery pages, potentially compromising site security and affecting user trust.

Affected Version(s)

Envira Gallery 0 < 1.16.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-104652 - Proof of Concept

References

https://wpscan.com/vulnerability/bbeb86c6-201e-4d43-9290-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Ryan Albon
WPScan
.