Stored Cross-Site Scripting in Photos and Social Share Buttons Plugin for WordPress
CVE-2025-1513

6.1MEDIUM

Key Information:

Vendor
WordPress
Status
Photos, Files, Youtube, Twitter, Instagram, Tiktok, Ecommerce Contest Gallery – Upload, Vote, Sell Via Paypal Or Stripe, Social Share Buttons
Vendor
CVE Published:
28 February 2025

Summary

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability. This security flaw arises from inadequate input sanitization and output escaping in the Name and Comment fields during photo gallery comments. Attackers can exploit this vulnerability to inject malicious web scripts. Once an affected page is accessed by a user, the injected scripts could execute, leading to potential data breaches and compromised user security.

Affected Version(s)

Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons * <= 26.0.0.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D.Sim
.