[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQioFzve3krtpQVngyxSDJlT6anT3hqn9HxXYzwIdNVc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-4766","easy-image-gallery-authenticated-contributor-stored-cross-site-scripting-via-gallery-shortcode-post-meta","Easy Image Gallery \u003C= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta","The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and including, 1.5.3. This is due to insufficient input sanitization and output escaping on user-supplied gallery shortcode values. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","easy-image-gallery",null,"\u003C=1.5.3","medium",6.4,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-03-20 15:17:28","2026-03-25 01:25:06",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe7279f74-c2bd-4601-b8d5-0effe43705a5?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2024-4766 (Easy Image Gallery \u003C= 1.5.3)\n\n## 1. Vulnerability Summary\nThe **Easy Image Gallery** plugin for WordPress is vulnerable to **Stored Cross-Site Scripting (XSS)** in versions up to 1.5.3. The vulnerability exists because the plugin fails to sanitize and escape user-supplied input stored in post meta fields associated with its gallery functionality. Specifically, when a user with Contributor-level permissions or higher saves a post, they can inject malicious scripts into gallery-related metadata. These scripts are then executed in the context of any user (including Administrators) who views the post on the frontend or edits it in the backend.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `wp-admin\u002Fpost.php` (Standard WordPress post update handler).\n- **Action:** `editpost`.\n- **Vulnerable Parameters (inferred):** `easy_image_gallery_link_target`, `easy_image_gallery_custom_link`, or internal meta fields used to store attributes for the `[easy_image_gallery]` shortcode.\n- **Authentication:** Required (Contributor-level or higher).\n- **Preconditions:** The plugin must be active, and a post containing (or intended to contain) a gallery must be edited.\n\n## 3. Code Flow (Inferred)\n1.  **Entry Point (Admin):** A user with `edit_posts` capability (Contributor+) visits the post editor.\n2.  **Meta Box Registration:** The plugin registers a meta box using `add_meta_box` (likely in `includes\u002Fadmin\u002Fmetabox.php` or `easy-image-gallery.php`).\n3.  **Data Processing (Save):** When the post is saved, a hook for `save_post` (e.g., `easy_image_gallery_save_post_meta`) captures input from `$_POST`.\n4.  **Insecure Storage:** The code likely uses `update_post_meta( $post_id, '_easy_image_gallery_...', $_POST['...'] )` without calling `sanitize_text_field()` or `esc_attr()`.\n5.  **Frontend Sink:** When the post is rendered, the plugin retrieves meta via `get_post_meta()`.\n6.  **Unescaped Output:** The values are echoed directly into the HTML (e.g., inside an `\u003Ca>` tag's `target` or `href` attribute) in the frontend gallery template or via the `[easy_image_gallery]` shortcode handler.\n\n## 4. Nonce Acquisition Strategy\nThis is an **authenticated** exploit targeting the WordPress admin dashboard. The agent must obtain a valid WordPress core nonce for the `editpost` action.\n\n1.  **Log in** as a Contributor user.\n2.  **Navigate** to `wp-admin\u002Fpost-new.php` to initiate a new post.\n3.  **Extract Data:** Use `browser_eval` to extract the `post_ID` and the `_wpnonce` from the page source.\n    - `post_ID` is found in the hidden input `name=\"post_ID\"`.\n    - `_wpnonce` is found in the hidden input `name=\"_wpnonce\"`.\n4.  **Identify Meta Fields:** Inspect the Easy Image Gallery meta box. Based on plugin structure, look for fields with names like `easy_image_gallery_link_target`.\n\n## 5. Exploitation Strategy\n1.  **Authentication:** Login as a Contributor.\n2.  **Initial Post Creation:**\n    - Navigate to `wp-admin\u002Fpost-new.php`.\n    - Capture `post_ID` and `_wpnonce`.\n3.  **Inject Payload:**\n    - Perform an `http_request` (POST) to `wp-admin\u002Fpost.php`.\n    - **Payload:** `\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>`\n    - **Target Parameter:** `easy_image_gallery_link_target` (common in this plugin for XSS).\n    - **Request Body:**\n      ```\n      action=editpost\n      post_ID=[CAPTURED_ID]\n      _wpnonce=[CAPTURED_NONCE]\n      post_title=Gallery Test\n      content=[easy_image_gallery]\n      easy_image_gallery_link_target=\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n      ```\n4.  **Trigger Execution:** Navigate to the frontend URL of the created post: `\u002F?p=[POST_ID]`.\n\n## 6. Test Data Setup\n1.  **User:** Create a user with the `Contributor` role.\n2.  **Plugin Configuration:** Ensure \"Easy Image Gallery\" is active.\n3.  **Post Content:** A post must contain the shortcode `[easy_image_gallery]` to trigger the rendering logic that fetches the malicious meta.\n\n## 7. Expected Results\n- The POST request should return a `302 Redirect` back to the post edit page (indicating success).\n- When navigating to the frontend post URL, an alert box showing the document domain should appear.\n- Inspection of the HTML source should show the script tag injected into the gallery's container or link attributes.\n\n## 8. Verification Steps\n1.  **WP-CLI Check:** Verify the meta was saved without sanitization:\n    ```bash\n    wp post meta get [POST_ID] easy_image_gallery_link_target\n    ```\n2.  **Frontend Check:** Use `browser_navigate` to the post and check for the presence of the script in the DOM:\n    ```javascript\n    \u002F\u002F browser_eval\n    document.body.innerHTML.includes('\u003Cscript>alert(document.domain)\u003C\u002Fscript>')\n    ```\n\n## 9. Alternative Approaches\nIf `easy_image_gallery_link_target` is not the correct parameter:\n- **Check for Hidden Meta:** Some versions store gallery image IDs in `_easy_image_gallery`. Try injecting into parameters that might be used as \"Custom Link\" attributes for individual images.\n- **Shortcode Attributes:** If the plugin allows custom attributes in the shortcode that are saved to meta (e.g., through a \"Settings\" tab in the meta box), target those fields.\n- **Injected Payload Variation:** If the sink is inside an attribute, use: `x\" onmouseover=\"alert(1)\"`. If inside a URL, use: `javascript:alert(1)`.","The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery link target and other meta fields. Authenticated attackers with Contributor-level access or higher can inject malicious scripts into post meta, which are then rendered without proper escaping when the gallery shortcode is displayed on the frontend.","\u002F\u002F In includes\u002Fadmin\u002Fmetabox.php (inferred based on plugin structure)\nfunction easy_image_gallery_save_post_meta( $post_id ) {\n    if ( isset( $_POST['easy_image_gallery_link_target'] ) ) {\n        \u002F\u002F Vulnerable: Metadata is updated without sanitization\n        update_post_meta( $post_id, '_easy_image_gallery_link_target', $_POST['easy_image_gallery_link_target'] );\n    }\n}\n\n---\n\n\u002F\u002F In includes\u002Fshortcode.php (inferred rendering logic)\n$link_target = get_post_meta( get_the_ID(), '_easy_image_gallery_link_target', true );\n\u002F\u002F Vulnerable: Output is echoed without escaping within an attribute context\necho '\u003Ca href=\"#\" target=\"' . $link_target . '\">...\u003C\u002Fa>';","--- a\u002Fincludes\u002Fadmin\u002Fmetabox.php\n+++ b\u002Fincludes\u002Fadmin\u002Fmetabox.php\n@@ -10,7 +10,7 @@\n function easy_image_gallery_save_post_meta( $post_id ) {\n     if ( isset( $_POST['easy_image_gallery_link_target'] ) ) {\n-        update_post_meta( $post_id, '_easy_image_gallery_link_target', $_POST['easy_image_gallery_link_target'] );\n+        update_post_meta( $post_id, '_easy_image_gallery_link_target', sanitize_text_field( $_POST['easy_image_gallery_link_target'] ) );\n     }\n }\n--- a\u002Fincludes\u002Fshortcode.php\n+++ b\u002Fincludes\u002Fshortcode.php\n@@ -50,5 +50,5 @@\n $link_target = get_post_meta( get_the_ID(), '_easy_image_gallery_link_target', true );\n-echo '\u003Ca href=\"#\" target=\"' . $link_target . '\">...\u003C\u002Fa>';\n+echo '\u003Ca href=\"#\" target=\"' . esc_attr( $link_target ) . '\">...\u003C\u002Fa>';","1. Log in as a user with Contributor-level access or higher.\n2. Navigate to 'Posts' -> 'Add New' or edit an existing post.\n3. Locate the 'Easy Image Gallery' meta box. If the 'Link Target' field is not visible, use a proxy tool or browser console to submit a POST request to 'wp-admin\u002Fpost.php' with 'action=editpost'.\n4. Include the parameter 'easy_image_gallery_link_target' (or the equivalent internal meta field) set to a malicious payload like '\">\u003Cscript>alert(document.domain)\u003C\u002Fscript>'.\n5. Add the '[easy_image_gallery]' shortcode to the post content and save\u002Fupdate the post.\n6. View the published post on the frontend as any user. The script will execute because the plugin fails to escape the 'target' attribute when rendering the gallery links.","gemini-3-flash-preview","2026-04-18 00:45:48","2026-04-18 00:46:09",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Feasy-image-gallery\u002Ftags"]