Stored Cross-Site Scripting in 3D Photo Gallery Plugin for WordPress

CVE-2024-13751

What is CVE-2024-13751?

The 3D Photo Gallery plugin for WordPress exhibits a vulnerability allowing Stored Cross-Site Scripting through the 'des[]' parameter. This weakness is present in all versions up to and including 1.3, attributable to inadequate input validation and output escaping. The flaw permits authenticated users with Subscriber-level access and higher to embed malicious web scripts. When other users navigate to pages containing these injected scripts, they may unknowingly execute these harmful actions, potentially compromising user data and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References