Stored Cross-Site Scripting Vulnerability in Photo Gallery by 10Web for WordPress

CVE-2023-6924

Summary

The Photo Gallery by 10Web plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on user-supplied attributes. This vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. The malicious scripts can then execute when any user accesses those introduced pages, potentially leading to serious security breaches. The risk is heightened for attackers with contributor-level access if additional page builder plugins are utilized.

References