PT-2021-16398

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web WordPress plugin versions prior to 1.5.68 Description: The issue is related to Reflected Cross-Site Scripting XSS via the bwg album breadcrumb 0 and shortcode id GET parameters passed to the bwg frontend data AJAX...

CVE-2021-24526

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24362

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will b...

Cross site scripting

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue...

Path traversal

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector...

CVE-2021-24526

CVE-2021-24526 affects the WordPress plugin Form Maker (by 10Web) prior to version 1.13.60. The issue is an authenticated Stored XSS caused by not escaping the Form Title when outputting it in an HTML attribute while editing a form in the admin dashboard. Impact is limited to authenticated users ...

CVE-2021-24363

CVE-2021-24363 affects the WordPress plugin Photo Gallery by 10Web – Mobile-Friendly Image Gallery, prior to version 1.5.75. The vulnerability arises from improper enforcement that uploaded files stay within the plugin’s uploads folder, enabling a path traversal that could allow high-privilege us...

CVE-2021-24362 Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will b...

CVE-2021-24362

The CVE-2021-24362 entry concerns the WordPress plugin “Photo Gallery by 10Web – Mobile-Friendly Image Gallery” (older builds). Affected versions prior to 1.5.75 fail to sanitize uploaded SVG content, allowing a user who can add images to a gallery to upload an SVG containing JavaScript. When the...

PT-2021-16048

Name of the Vulnerable Software and Affected Versions The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin versions prior to 1.13.60 Description The issue is related to an authenticated Stored Cross-Site Scripting problem. It occurs because the Form Title is...

CVE-2021-24363: Improper Limitation of a Pathname to a Restricted Directory

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector...

PT-2021-15899

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin versions prior to 1.5.75 Description The issue allows high privilege users to upload files outside of the intended uploads folder due to a path traversal vector,...

CVE-2021-24526: Improper Neutralization of Input During Web Page Generation

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24362: Improper Neutralization of Input During Web Page Generation

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will b...

PT-2021-15898

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin versions prior to 1.5.75 Description The issue arises from the plugin's failure to ensure that uploaded SVG files added to a gallery do not contain malicious content...

WordPress plugin has an unspecified vulnerability (CNVD-2021-59599)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. Backup by 10Web WordPress Plugin 1.0.20 and earlier has...

Cross site scripting

The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue...

CVE-2021-24426

The CVE-2021-24426 issue affects the WordPress plugin Backup by 10Web – Backup and Restore (versions up to 1.0.20). The underlying flaw is failure to sanitize/escape the tab parameter before echoing it in the page, which enables a reflected Cross-Site Scripting (XSS) vulnerability. Several connec...

CVE-2021-24426: Improper Neutralization of Input During Web Page Generation

The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue...

PT-2021-15956

Name of the Vulnerable Software and Affected Versions The Backup by 10Web – Backup and Restore Plugin WordPress plugin versions 1.0.20 and earlier Description The issue is related to a reflected Cross-Site Scripting problem. It occurs because the tab parameter is not properly sanitised or escaped...