CVE-2021-24357 FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting

2021-06-1413:37:14

CWE-79

WPScan

www.cve.org

cve-2021-24357

foogallery

authenticated

stored

cross-site scripting

wordpress

plugin

custom css

validation

sanitised

EPSS

0.001

Percentile

24.8%

JSON

In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue.

CNA Affected

[
  {
    "product": "Best Image Gallery & Responsive Photo Gallery – FooGallery",
    "vendor": "FooPlugins",
    "versions": [
      {
        "lessThan": "2.0.35",
        "status": "affected",
        "version": "2.0.35",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/950f46ae-4476-4969-863a-0e55752953b3

EPSS

0.001

Percentile

24.8%

JSON

Related for CVELIST:CVE-2021-24357