Stored Cross-Site Scripting Vulnerability in 10Web Photo Gallery for WordPress

CVE-2024-9878

4.8MEDIUM

Key Information

Vendor: 10web
Status: Photo Gallery By 10web – Mobile-friendly Image Gallery
Vendor: CVE Published:; 5 November 2024

Summary

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Affected Version(s)

Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.30

CVSS V3.1

Score:

4.8

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published.
Nov 5, 2024
Disclosed
Nov 4, 2024
Vulnerability Reserved.
Oct 11, 2024

Collectors

NVD DatabaseMitre Database

Credit

tmrswrr