Lucene search
PRIOn knowledge basePRION:CVE-2022-3991HistoryNov 29, 2022 - 9:15 p.m.
Cross site scripting
2022-11-2921:15:00
PRIOn knowledge base
www.prio-n.com
3
photospace gallery
wordpress
stored cross-site scripting
input sanitization
output escaping
authenticated attackers
subscriber-level permissions
0.001 Low
EPSS
Percentile
21.5%
The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
| CPE | Name | Operator | Version |
|---|---|---|---|
| photospace_gallery | le | 2.3.5 |
Related
nvd
nvd
CVE-2022-3991
2022-11-29 21:15:11
cnvd
cnvd
WordPress Photospace Gallery plugin cross-site scripting vulnerability
2022-11-30 00:00:00
cvelist
cvelist
CVE-2022-3991
2022-11-29 20:43:32
wpvulndb
wpvulndb
Photospace Gallery <= 2.3.5 - Subscriber+ Stored Cross-Site Scripting
2022-11-14 00:00:00
cve
cve
CVE-2022-3991
2022-11-29 21:15:11