Image Photo Gallery Final Tiles Grid < 3.5.3 - Contributor+ Stored Cross-Site Scripting
CVE-2022-0186

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Image Photo Gallery Final Tiles Grid
Vendor
CVE Published:
21 February 2022

Summary

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard

Affected Version(s)

Image Photo Gallery Final Tiles Grid 3.5.3

References

https://wpscan.com/vulnerability/3a9c44c0-866e-4fdf-b53d-...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Harshit (aka fumenoid)
Siddhant Chouhan (aka sidchn)
.