このページはまだあなたの言語に翻訳されていません。翻訳作業中のため、英語でコンテンツを表示しています。
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-5361: XSS in Envira Gallery Lite WordPress Plugin
プラットフォーム
wordpress
コンポーネント
envira-gallery-lite
修正版
1.12.5
CVE-2026-5361 describes a Stored Cross-Site Scripting (XSS) vulnerability affecting the Envira Gallery Lite plugin for WordPress. This vulnerability allows attackers to inject malicious scripts into the gallery, potentially leading to unauthorized code execution within a user's browser. The vulnerability impacts versions 1.0.0 through 1.12.4 and is resolved in version 1.12.5.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
影響と攻撃シナリオ翻訳中…
An attacker exploiting this XSS vulnerability could inject arbitrary JavaScript code into the Envira Gallery Lite plugin. This code could then be executed in the browsers of users viewing the affected gallery. The impact ranges from simple defacement and redirection to more severe consequences like stealing session cookies, phishing attacks, or even gaining control of the user's WordPress account. The REST API endpoint is a common target for such attacks, and successful exploitation could impact a significant number of WordPress sites using the Envira Gallery Lite plugin. The lack of proper sanitization of the 'arrows' parameter is the root cause, allowing attackers to bypass security measures.
悪用の状況翻訳中…
CVE-2026-5361 was published on 2026-05-14. Severity is rated as Medium (CVSS 6.4). No public exploits or active campaigns have been reported as of this writing. The vulnerability is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation. Refer to the official Envira Gallery Lite advisory for further details.
脅威インテリジェンス
エクスプロイト状況
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- 低 — 有効なユーザーアカウントがあれば十分。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化あり — 攻撃が脆弱なコンポーネントを超えて他のシステムに波及可能。
- Confidentiality
- 低 — 一部データへの部分的アクセス。
- Integrity
- 低 — 限定的な範囲でデータ変更可能。
- Availability
- なし — 可用性への影響なし。
影響を受けるソフトウェア
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- 更新日
緩和策と回避策翻訳中…
The primary mitigation for CVE-2026-5361 is to upgrade the Envira Gallery Lite plugin to version 1.12.5 or later. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block requests to the vulnerable REST API endpoint with suspicious parameters. Carefully review any custom code interacting with the gallery data to ensure proper input sanitization and output escaping. Monitor WordPress logs for unusual activity or attempts to access the REST API with potentially malicious payloads.
修正方法
バージョン1.12.5、またはそれ以降の修正バージョンにアップデートしてください
よくある質問翻訳中…
What is CVE-2026-5361 — XSS in Envira Gallery Lite?
CVE-2026-5361 is a Stored Cross-Site Scripting (XSS) vulnerability in the Envira Gallery Lite WordPress plugin, allowing attackers to inject malicious scripts via the REST API.
Am I affected by CVE-2026-5361 in Envira Gallery Lite?
You are affected if you are using Envira Gallery Lite versions 1.0.0 through 1.12.4. Check your plugin version and update if necessary.
How do I fix CVE-2026-5361 in Envira Gallery Lite?
Upgrade the Envira Gallery Lite plugin to version 1.12.5 or later. Consider WAF rules as a temporary mitigation if upgrading is not immediately possible.
Is CVE-2026-5361 being actively exploited?
As of now, there are no reports of active exploitation or public exploits for CVE-2026-5361, but vigilance is still advised.
Where can I find the official Envira Gallery Lite advisory for CVE-2026-5361?
Refer to the official Envira Gallery Lite website and WordPress plugin repository for the latest advisory and update information.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
WordPressプロジェクトを今すぐスキャン — アカウント不要
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
依存関係ファイルをドラッグ＆ドロップ
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...