CVE-2022-4058

2022-12-1914:15:11

[email protected]

web.nvd.nist.gov

cve-2022-4058

photo gallery

10web

wordpress

xss

security issue

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

23.4%

JSON

The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.

Affected configurations

Vulners

NVD

Node

10webphoto_galleryRange<1.8.3

VendorProductVersionCPE
10webphoto_gallery*cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
10web	photo_gallery	*	cpe:2.3:a:10web:photo_gallery::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Photo Gallery by 10Web",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.8.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]