--- cve: "CVE-2026-5361" severity: "MEDIUM" cvss: 6.4 epss: "35%" vendor: "smub" kev: false exploited: false published: "2026-05-14 05:16:44" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-06T18:38:01+02:00" --- # CVE-2026-5361 > 6.4 MEDIUM ## Beschreibung The Envira Gallery Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API in versions up to and including 1.12.4. This is due to insufficient input sanitization in the update_gallery_data() function and improper output escaping in the gallery_init() function. The sanitize_config_values() function only sanitizes the justified_gallery_theme and justified_row_height parameters, but does not sanitize the arrows parameter. When the arrows value is output in the inline JavaScript configuration, it uses esc_attr() which is designed for HTML attribute contexts, not JavaScript contexts, allowing JavaScript expression injection. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Gering | warn | | UI Interaktion | Keine | bad | | S Scope | Verändert | bad | | C Vertraulichkeit | Gering | warn | | I Integrität | Gering | warn | | A Verfügbarkeit | Keine | good | ## Referenzen - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-5361) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_