CVE-2022-1282 Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting

2022-05-0216:05:58

CWE-79

WPScan

www.cve.org

7.1 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.0%

JSON

The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET[‘image_url’] variable, which is reflected back to the users when executing the editimage_bwg AJAX action.

CNA Affected

[
  {
    "product": "Photo Gallery by 10Web – Mobile-Friendly Image Gallery",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.6.3",
        "status": "affected",
        "version": "1.6.3",
        "versionType": "custom"
      }
    ]
  }
]