Stored Cross-Site Scripting in 3D Photo Gallery Plugin for WordPress

CVE-2024-13751

What is CVE-2024-13751?

The 3D Photo Gallery plugin for WordPress exhibits a vulnerability allowing Stored Cross-Site Scripting through the 'des[]' parameter. This weakness is present in all versions up to and including 1.3, attributable to inadequate input validation and output escaping. The flaw permits authenticated users with Subscriber-level access and higher to embed malicious web scripts. When other users navigate to pages containing these injected scripts, they may unknowingly execute these harmful actions, potentially compromising user data and security.

References