Stored Cross-Site Scripting Vulnerability in Gallery Custom Links Plugin for WordPress

CVE-2026-107757

What is CVE-2026-107757?

The Gallery Custom Links plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping. This vulnerability allows authenticated users with subscriber-level access or higher to inject arbitrary web scripts into the comment section of affected pages. The attack requires two coordinated inputs from the same user: an HTML comment payload inserted in the comment body, which WordPress preserves verbatim, and a noise key placed in the user’s display name that survives the necessary escaping functions, allowing the injected scripts to execute whenever a user accesses the compromised pages.

References