CVE-2022-4058 Photo Gallery < 1.8.3 - Stored XSS via CSRF

2022-12-1913:41:43

WPScan

www.cve.org

photo gallery

wordpress plugin

stored xss

0.001 Low

EPSS

Percentile

23.5%

JSON

The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Photo Gallery by 10Web",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.8.3"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

wpscan.com/vulnerability/89656cb3-4611-4ae7-b7f8-1b22eb75cfc4

0.001 Low

EPSS

Percentile

23.5%

JSON

Related for CVELIST:CVE-2022-4058