CVE-2023-5307 Photos and Files Contest Gallery – Contact Form < 21.2.8.1 - Unauthenticated Stored XSS via HTTP Headers

2023-10-3113:54:43

WPScan

raw.githubusercontent.com

photos and files contest gallery

unauthenticated

xss

vulnerability

wordpress

plugin

http headers

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.3%

JSON

The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.