CVE-2026-1236 | Envira Gallery Plugin up to 1.12.3 on WordPress REST API justified_gallery_theme cross site scripting

A vulnerability marked as problematic has been reported in Envira Gallery Plugin up to 1.12.3 on WordPress. This vulnerability affects unknown code of the component REST API. Performing a manipulation of the argument justified_gallery_theme results in cross site scripting.

This vulnerability is identified as CVE-2026-1236. The attack can be initiated remotely. There is not any exploit available.