What’s Vulnerable › Vulnerabilities

CVE-2020-35581

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-01-15 · updated 2026-06-17
• Weakness: CWE-79

Description

A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/admin-ajax.php request with the meta[title] parameter.

Affected products

• smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More: before 1.8.3.3 — fixed in 1.8.3.3

How to fix

Upgrade to a fixed version: smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More 1.8.3.3. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/160924/Envira-Gallery-Lite-1.8.3.2-Cross-Site-Scripting.html
• https://github.com/enviragallery/envira-gallery-lite/blob/master/changelog.txt
• https://github.com/enviragallery/envira-gallery-lite/commit/102651514e6faca914ec1c7e113def340d8e1e09
• https://github.com/enviragallery/envira-gallery-lite/commit/3b081dd10a1731f8cd981bebeac0e775fb217acf
• http://packetstormsecurity.com/files/160924/Envira-Gallery-Lite-1.8.3.2-Cross-Site-Scripting.html
• https://github.com/enviragallery/envira-gallery-lite/blob/master/changelog.txt
• https://github.com/enviragallery/envira-gallery-lite/commit/102651514e6faca914ec1c7e113def340d8e1e09
• https://github.com/enviragallery/envira-gallery-lite/commit/3b081dd10a1731f8cd981bebeac0e775fb217acf

Get alerted when CVE-2020-35581 or the next vulnerability affects your stack