NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS)
CVE-2021-24293

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Nextgen Gallery Pro
Vendor
CVE Published:
5 May 2021

What is CVE-2021-24293?

In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.

Affected Version(s)

NextGen Gallery Pro 3.1.11

References

https://wpscan.com/vulnerability/5e1a4725-3d20-44b0-8a35-...
x_refsource_CONFIRM
https://www.imagely.com/wordpress-gallery-plugin/nextgen-...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mgthuramoemyint
.