CVE-2023-5307

Photos and Files Contest Gallery – Contact Form < 21.2.8.1 - Unauthenticated Stored XSS via HTTP Headers

Medium · published October 31, 2023

CVSS v3.1
6.1
EPSS
1%
Percentile
41.7
In the wild
Unconfirmed
What it is

The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00501 · 41.7th percentile
Published
2023-10-31T13:54Z
EPSS history
Timeline
  • 31 OCT 13:54Z
    Photos and Files Contest Gallery – Contact Form < 21.2.8.1 - Unauthenticated Stored XSS via HTTP Headers
    cvelistv5