Vulnerability · Published Jun 1, 2021 · Assigned by WPScan
CVE-2021-24310Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title
Medium 4.8
In plain English
A medium-severity cross-site scripting in Photo Gallery by 10Web – Mobile-Friendly Image Gallery from 10Web. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).
Severity (CVSS NVD)4.8Medium
Exploit odds (30 days)1.1%top 33.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 10Web | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 1.5.67 – before 1.5.67 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/f34096ec-b1b0-471d-88a4-4699178a3165 x_refsource_CONFIRM