CVE-2021-24310CWE-79

Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title

published June 1, 2021

CVSS
—
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01131 · 66.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-06-01T11:33Z
EPSS history
Timeline
  • 01 JUN 11:33Z
    Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title
    cvelistv5