Simple Photoswipe <= 0.1 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1 As admin, go to plugin settings...

PhotoSwipe 5.3.7 Arbitrary File Download

=========================================================================================== | Title : PhotoSwipe 5.3.7 Arbitrary File Download Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 103.064-bit | | Vendor : https://photoswipe.com...

CVE-2022-0750

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnailwidth, thumbnailheight, maximagewidth, and maximageheight parameters found in the /photoswipe-masonry.php file which allows authenticated attackers t...

CVE-2022-0750

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnailwidth, thumbnailheight, maximagewidth, and maximageheight parameters found in the /photoswipe-masonry.php file which allows authenticated attackers t...

Cross site scripting

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnailwidth, thumbnailheight, maximagewidth, and maximageheight parameters found in the /photoswipe-masonry.php file which allows authenticated attackers t...

CVE-2022-0750 Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scripting

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnailwidth, thumbnailheight, maximagewidth, and maximageheight parameters found in the /photoswipe-masonry.php file which allows authenticated attackers t...

CVE-2022-0750 Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scripting

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnailwidth, thumbnailheight, maximagewidth, and maximageheight parameters found in the /photoswipe-masonry.php file which allows authenticated attackers t...

CVE-2022-0750

The CVE-2022-0750 issue affects the WordPress Photoswipe Masonry Gallery plugin (versions up to 1.2.14). The root cause is insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters in photoswipe-masonry.php, enabling authenti...

PT-2022-13410 · WordPress · Photoswipe Masonry Gallery

Name of the Vulnerable Software and Affected Versions: Photoswipe Masonry Gallery WordPress plugin versions up to and including 1.2.14 Description: The issue arises from insufficient escaping and sanitization of the thumbnail width, thumbnail height, max image width, and max image height paramete...

WordPress Photoswipe Masonry Gallery plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Photoswipe Masonry Gallery plugin has a cross-site scripting vulnerability, which can be exploited by...

WordPress plugin Photoswipe Masonry Gallery 跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Photoswipe Masonry Gallery plugin has a cross-site scripting vulnerability, which can be exploited by...

WordPress Photoswipe Masonry Gallery 1.2.14 Cross Site Scripting

On November 11, 2021 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in “Photoswipe Masonry Gallery”, a WordPress plugin that is installed on over 10,000 sites. This flaw makes it possible for an authenticated attacker to injec...

Photoswipe Masonry Gallery < 1.2.15 - Subscriber+ Stored Cross-Site Scripting

The plugin does not have authorisation and CSRF when updating its gallery settings via the update function hooked to adminmenu, allowing any authenticated users, such as subscriber to update them and set Cross-Site Scripting payloads in them due to the lack of sanitisation and escaping...

WordPress Photoswipe Masonry Gallery plugin <= 1.2.14 - Subscriber+ Plugin Settings Update vulnerability

Subscriber+ Plugin Settings Update vulnerability discovered in WordPress Photoswipe Masonry Gallery plugin versions = 1.2.14. Solution Update the WordPress Photoswipe Masonry Gallery plugin to the latest available version at least 1.2.15...

WordPress WooCommerce Plugin < 3.5.5 XSS Vulnerability - Windows

The WooCommerce plugin for WordPress is prone to a Cross-Site Scripting XSS vulnerability. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Cross-Site Scripting (XSS)

woocommerce/woocommerce is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the Photoswipe caption parameter...

Cross site scripting

WooCommerce before 3.5.5 allows XSS via a Photoswipe caption...

CVE-2019-9168

WooCommerce before 3.5.5 allows XSS via a Photoswipe caption...

CVE-2019-9168

WooCommerce before 3.5.5 allows XSS via a Photoswipe caption...

CVE-2019-9168

CVE-2019-9168 affects the WordPress WooCommerce plugin prior to version 3.5.5. The vulnerability is a cross-site scripting (XSS) flaw in the Photoswipe caption handling, where user-supplied data in the caption can be interpreted as script. The root cause is insufficient sanitization of the captio...