# Image Gallery Block <= 1.4.1 - Authenticated (Contributor+) CSS Injection via Block Style Attributes

- **ID:** WPSEC-2026-3034
- **Plugin:** Image Gallery Block (`image-gallery-block`), https://wordpress.org/plugins/image-gallery-block/
- **Affected versions:** from 1.2.2 before 1.4.2
- **Fixed in:** 1.4.2 (Update to 1.4.2 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/image-gallery-block
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3034/

## Description

The Image Gallery Block plugin for WordPress is vulnerable to CSS Injection via block CSS attributes (blockMeta, commonStyles and customCss) in all versions up to, and including, 1.4.1, due to missing and later insufficient sanitization of block CSS saved by users without the unfiltered_html capability before it is written to the post's public stylesheet. Versions before 1.4.1 wrote this CSS without any sanitization. The sanitizer added in 1.4.1 could be bypassed with CSS comments that split keywords or sit inside url(), non-hex CSS escapes in function names, an unclosed url() at the end of the input, and stylesheets written earlier were never rebuilt. This makes it possible for authenticated attackers with contributor-level access and above to inject off-site url() loads  into the CSS served with the post. Visitors' page data can then be leaked through attribute selectors, or the page can be visually altered.

## References

- https://wpsec.com/vuln/WPSEC-2026-3034/
- https://plugins.svn.wordpress.org/image-gallery-block/tags/1.4.2/
- https://wordpress.org/plugins/image-gallery-block/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3034/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.