Image Gallery - Grid Gallery < 1.1.6 - Admin+ Stored Cross-Site Scripting

2022-06-0300:00:00

Fayçal CHENA

0.001 Low

EPSS

Percentile

24.8%

JSON

The plugin does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Create a gallery with the "Gallery Theme" set to "Gallery Image 2", add an image and put the following payload in the "Image Description" field: <svg/onload=alert(/XSS/)>
Save the image and gallery and view a post/page where the gallery is embed to trigger the XSS

The "Image Title" field is also vulnerable, with a payload such as "><img src onerror=alert(/XSS/)> (fixed in 1.1.5)

0.001 Low

EPSS

Percentile

24.8%

JSON

Related for WPEX-ID:6B71EB38-0A4A-49D1-96BC-84BBE675BE1E