CVE-2026-57755: XSS Vulnerability in Mosaic Gallery Advanced Gallery ≤1.2.0

Technical summary

CVE-2026-57755 is a stored XSS vulnerability (CWE-79) in Mosaic Gallery — Advanced Gallery affecting versions up to and including 1.2.0. The vulnerability exists in functionality accessible to authenticated contributors, allowing injection of arbitrary script content into gallery data. The injected payload persists in the database and executes when administrative or higher-privileged users interact with the affected gallery content. The CVSS 3.1 score of 6.5 (MEDIUM severity) reflects the requirement for authenticated access and user interaction, though the cross-site scope increases impact potential across the affected application.

Business impact

Organizations running vulnerable versions face credential theft, session hijacking, and unauthorized account takeover of administrative accounts. If exploited, attackers could escalate privileges, modify site content, or pivot to backend systems. The risk is elevated in multi-user WordPress environments where contributor access is granted to external writers, agencies, or community members. Data integrity and user trust may be compromised if gallery content is manipulated or defaced.

Affected systems

Mosaic Gallery — Advanced Gallery versions 1.2.0 and earlier running on WordPress or compatible platforms are affected. Sites with untrusted or poorly vetted contributors carry higher risk. The vulnerability does not affect versions released after 1.2.0; verify your installed version in the plugin settings or WordPress admin dashboard.

Exploitability

Exploitation requires an authenticated account with contributor or author privileges. The attack vector is network-based with low complexity—no special tools or deep technical expertise is needed beyond basic XSS payload knowledge. User interaction is required, as a higher-privileged user must view or interact with the malicious gallery content for the attack to succeed. The stored nature of the XSS makes it difficult to detect without security monitoring and increases the window of exposure once injected.

Remediation

Update Mosaic Gallery — Advanced Gallery to the latest version released after 1.2.0. Verify the update through the plugin's official repository or vendor advisory. Additionally, audit contributor account permissions and revoke access for inactive or untrusted accounts. Implement input validation and output encoding controls at the application level to prevent stored XSS. Enable WordPress security plugins that provide XSS detection and content security policy (CSP) headers.

Patch guidance

Check the Mosaic Gallery plugin page for available updates. If a patched version beyond 1.2.0 is available, update immediately through the WordPress admin panel or verify against the vendor's official security advisory. Test the update in a staging environment first to ensure compatibility with your site's theme and other plugins. After patching, clear browser cache and purge any CDN caches to ensure injected payloads are not served from cached copies.

Detection guidance

Monitor for suspicious JavaScript or script tags within gallery content using security scanning tools or manual code review of gallery database entries. Enable WordPress logging and audit plugins to track changes to gallery settings and uploads. Use a Web Application Firewall (WAF) configured with XSS detection rules to flag unusual script patterns in requests. Review admin access logs for unauthorized modifications to gallery content or unexpected administrative actions during the vulnerability window.

Why prioritize this

Although CVSS 6.5 is MEDIUM severity, prioritization depends on your threat model. If your site restricts contributor access to trusted internal staff only, risk is lower. If external contributors or community members have posting rights, this should be treated as HIGH priority because stored XSS targeting admins can lead to full site compromise. Factor in whether you use WordPress for sensitive business operations or customer-facing content.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: (1) network accessibility and low attack complexity (easy exploitation), (2) requirement for prior authentication and user interaction (moderate friction), and (3) potential confidentiality, integrity, and availability impact limited to the application scope rather than the system. The cross-site scope modifier elevates the base score, recognizing that exploitation can affect multiple users or site functions, not just the gallery itself.

Frequently asked questions