Lucene search
IohexWPEX-ID:8C2ADADD-0684-49A8-9185-0C7D9581AEF1HistoryDec 06, 2022 - 12:00 a.m.
WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSS
2022-12-0600:00:00
iohex
169
wordpress
filter gallery
admin
stored xss
exploit
security
EPSS
0.001
Percentile
25.3%
The plugin does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled.
Create a new filter with the name "<svg onload('alert(123);')>", save it and reload the page.Related
cvelist
cvelist
CVE-2022-4142 WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSS
2023-01-02 21:49:17
wpvulndb
wpvulndb
WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSS
2022-12-06 00:00:00
cve
cve
CVE-2022-4142
2023-01-02 22:15:16
prion
prion
Design/Logic Flaw
2023-01-02 22:15:00
nvd
nvd
CVE-2022-4142
2023-01-02 22:15:16