Reflected Cross-Site Scripting in Photo Gallery Slideshow & Masonry Tiled Gallery Plugin for WordPress
CVE-2023-2402
6.1MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 9 June 2023
What is CVE-2023-2402?
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is affected by a critical vulnerability related to reflected cross-site scripting. This vulnerability arises due to insufficient input sanitization and output escaping in the handling of the search_term parameter. As a result, unauthenticated attackers could potentially exploit this weakness to inject arbitrary web scripts into the plugin's pages. If a user is tricked into clicking a malicious link, the injected scripts may execute in the context of their session, potentially compromising user data and site integrity.
Affected Version(s)
Photo Gallery Slideshow & Masonry Tiled Gallery * <= 1.0.13