CVE-2026-5743— WordPress SimpLy Gallery 跨站脚本漏洞

Mixed Media Gallery Blocks <= 3.3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via sliderMaxHeight Block Attribute

The SimpLy Gallery Block & Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block attributes in all versions up to, and including, 3.3.3.2. This is due to insufficient input sanitization and output escaping on the sliderMaxHeight block attribute in the pgc_sgb_render_callback() function. The vulnerability exists because the pgc_sgb_sanitize_custom_css() function uses a flawed regex pattern that only removes event handlers with quoted values (e.g., onfocus="alert()") but fails to catch unquoted event handlers (e.g., onfocus=alert(document.cookie)), allowing the malicious code to bypass sanitization. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages via block attributes that will execute whenever a user accesses an injected page.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

WordPress SimpLy Gallery 跨站脚本漏洞

WordPress SimpLy Gallery是WordPress基金会的一款 WordPress 图库插件，支持在区块编辑器中创建响应式图片、视频、音频混合媒体画廊、相册、滑块和灯箱效果。 SimpLy Gallery 3.3.3.2及之前版本存在跨站脚本漏洞，该漏洞源于对sliderMaxHeight块属性输入清理和输出转义不足，且pgc_sgb_sanitize_custom_css()函数使用的正则表达式存在缺陷，未能捕获无引号事件处理程序，容易受到存储型跨站脚本攻击。

N/A

N/A