CVE-2022-2190 Envira Gallery Lite < 1.8.4.7 - Reflected Cross-Site Scripting

2022-10-3100:00:00

CWE-79

WPScan

www.cve.org

cve-2022-2190

envira gallery lite

reflected cross-site scripting

wordpress plugin

0.001 Low

EPSS

Percentile

40.3%

JSON

The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER[‘REQUEST_URI’] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Gallery Plugin for WordPress – Envira Photo Gallery",
    "versions": [
      {
        "version": "1.8.4.7",
        "status": "affected",
        "lessThan": "1.8.4.7",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/1af4beb6-ba16-429b-acf2-43f9594f5ace

0.001 Low

EPSS

Percentile

40.3%

JSON

Related for CVELIST:CVE-2022-2190