Lucene search
HarshitWPEX-ID:3A9C44C0-866E-4FDF-B53D-666DB2E11720HistoryJan 18, 2022 - 12:00 a.m.
Image Photo Gallery Final Tiles Grid < 3.5.3 - Contributor+ Stored Cross-Site Scripting
2022-01-1800:00:00
Harshit
96
0.001 Low
EPSS
Percentile
25.0%
The plugin does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
As a contributor, create/edit a gallery and add the following payload in the Description field: "><img src onerror=alert(/XSS/)>
The XSS will be triggered when the gallery is edited (for example, by an admin checking it)Related
cve
cve
CVE-2022-0186
2022-02-21 11:15:09
patchstack
patchstack
cvelist
cvelist
nvd
nvd
CVE-2022-0186
2022-02-21 11:15:09
wpvulndb
wpvulndb
prion
prion
Cross site scripting
2022-02-21 11:15:00
cnvd
cnvd
WordPress插件Image Photo Gallery Final Tiles Grid跨站脚本漏洞
2022-02-23 00:00:00