Galleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via Shortcode

2023-02-0200:00:00

Lana Codes

142

galleries by angie makes

stored xss

shortcode

contributor

0.001 Low

EPSS

Percentile

23.3%

JSON

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

[gallery ids='1' captions="' onmouseover='alert(/XSS/)'"]

Note: ids is an attachment id from the media library

0.001 Low

EPSS

Percentile

23.3%

JSON

Related for WPEX-ID:5052E60F-59EA-4758-8AF3-112285A18639