Image Gallery Block <= 1.4.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes
- ID
- WPSEC-2026-3034
- Plugin
- Image Gallery Block (image-gallery-block)
- Affected
- from 1.2.2 before 1.4.2
- Remediation
- Update to 1.4.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Image Gallery Block on WPSec AttackSurface
- Fix released
- Published
Description
The Image Gallery Block plugin for WordPress is vulnerable to CSS Injection via block CSS attributes (blockMeta, commonStyles and customCss) in all versions up to, and including, 1.4.1, due to missing and later insufficient sanitization of block CSS saved by users without the unfiltered_html capability before it is written to the post's public stylesheet. Versions before 1.4.1 wrote this CSS without any sanitization. The sanitizer added in 1.4.1 could be bypassed with CSS comments that split keywords or sit inside url(), non-hex CSS escapes in function names, an unclosed url() at the end of the input, and stylesheets written earlier were never rebuilt. This makes it possible for authenticated attackers with contributor-level access and above to inject off-site url() loads into the CSS served with the post. Visitors' page data can then be leaked through attribute selectors, or the page can be visually altered.
References
- https://wpsec.com/vuln/WPSEC-2026-3034/
- https://plugins.svn.wordpress.org/image-gallery-block/tags/1.4.2/
- https://wordpress.org/plugins/image-gallery-block/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS