Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting
CVE-2022-1282

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Photo Gallery By 10web – Mobile-friendly Image Gallery
Vendor
CVE Published:
2 May 2022

Summary

The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.

Affected Version(s)

Photo Gallery by 10Web – Mobile-Friendly Image Gallery 1.6.3

References

https://wpscan.com/vulnerability/37a58f4e-d2bc-4825-8e1b-...
x_refsource_MISC
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JrXnm
.