CVE-2026-5191: Stored XSS in Tiled Gallery Carousel Without JetPack WordPress Plugin

Technical summary

CVE-2026-5191 is a stored XSS vulnerability (CWE-79) in the Tiled Gallery Carousel Without JetPack plugin affecting all versions through 3.1. The vulnerability stems from insufficient input sanitization and output escaping of the 'data-image-title' parameter. Authenticated users with contributor privileges or above can inject arbitrary JavaScript that persists in the page markup and executes in the context of subsequent visitor sessions, potentially achieving credential theft, session hijacking, or malware distribution within the WordPress environment.

Business impact

A successful attack could allow a malicious insider or compromised contributor account to deface pages, harvest visitor credentials, redirect users to phishing sites, or distribute malware. Multi-site WordPress installations are particularly at risk if contributor accounts are provisioned across multiple blogs. Customer trust, site integrity, and potential compliance violations (depending on data exposure) are the primary business concerns.

Affected systems

WordPress installations using the Tiled Gallery Carousel Without JetPack plugin version 3.1 and earlier are affected. The vulnerability requires authenticated access at the contributor level or above, limiting exposure to internal team members, clients with editing privileges, or attackers who have compromised such accounts. Sites running the plugin on publicly accessible WordPress instances represent higher risk.

Exploitability

Exploitation requires valid WordPress authentication and contributor-or-above privileges. An attacker cannot exploit this remotely as an unauthenticated user. However, in environments where contributor accounts are loosely controlled or shared, or where account compromise is likely, the threat is elevated. The attack itself is trivial once access is obtained: injecting malicious HTML/JavaScript into the 'data-image-title' parameter and publishing the page. No user interaction beyond viewing the page is required for the payload to execute.

Remediation

Update the Tiled Gallery Carousel Without JetPack plugin to a patched version beyond 3.1 as soon as available from the plugin repository. Until a patch is released, consider disabling the plugin, restricting contributor access to only trusted administrators, or using Web Application Firewall (WAF) rules to filter malicious payloads in gallery parameters. Review contributor accounts for suspicious activity and audit recent page edits.

Patch guidance

Check the WordPress plugin directory for available updates to the Tiled Gallery Carousel Without JetPack plugin. Patches addressing this vulnerability should be released by the plugin maintainer. Apply updates through the WordPress admin dashboard or via command line (wp plugin update). Verify patch deployment by confirming the running plugin version post-update. If no patch is available within a reasonable timeframe, consider migrating to an alternative gallery plugin or forking the code to apply a fix internally.

Detection guidance

Monitor for unusual modifications to pages and posts using the Tiled Gallery Carousel Without JetPack plugin, particularly edits by lower-privileged accounts. Inspect the 'data-image-title' parameter values in affected pages for JavaScript patterns (script tags, event handlers, encoded payloads). Check WordPress edit logs and revision history for suspicious contributor activity. Web application firewalls can flag attempts to inject script-like content into image title fields. Review site performance logs for unexpected JavaScript execution.

Why prioritize this

Although the CVSS score is MEDIUM (5.4), prioritization should be elevated in environments with loose contributor access controls or shared account credentials. The stored nature of this XSS creates persistent risk, and the ease of exploitation once authenticated makes rapid patching important. Organizations with public-facing WordPress sites and multiple contributors should patch quickly; those with highly restricted contributor access can take a more measured approach.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects network accessibility (AV:N) but requires authenticated access (PR:L) and user interaction (UI:R) to trigger the payload execution. The impact is confidentiality and integrity compromise (C:L, I:L) with no availability impact (A:N), and the scope is changed (S:C), indicating cross-system consequences. The score appropriately captures that this is not a critical flaw but demands attention given the ease of exploitation and persistence mechanism.

Frequently asked questions