CVE-2021-24349CWE-352CWE-79

Gallery From Files <= 1.6.0 - Reflected Cross-Site Scripting (XSS)

published June 14, 2021

CVSS
—
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. But filenames are not properly sanitized before being output in an error message when they have an invalid extension, leading to a reflected Cross-Site Scripting issue. Due to the lack of CSRF check, the attack could also be performed via such vector.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-06-14T13:37Z
EPSS history
Timeline
  • 14 JUN 13:37Z
    Gallery From Files <= 1.6.0 - Reflected Cross-Site Scripting (XSS)
    cvelistv5