Lucene search
WpvulndbWPEX-ID:FD312BFD-7C98-4682-877D-846442E9C6A2HistorySep 20, 2021 - 12:00 a.m.
Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site Scripting
2021-09-2000:00:00
wpvulndb
238
0.001 Low
EPSS
Percentile
22.7%
The plugin does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Log in as contributor and add the following shortcode in a post [vgallery id="=0; alert();x"]
Then view the post to trigger the XSSRelated
patchstack
patchstack
cvelist
cvelist
nvd
nvd
CVE-2021-24415
2021-10-18 14:15:08
wpvulndb
wpvulndb
Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site Scripting
2021-09-20 00:00:00
prion
prion
Cross site scripting
2021-10-18 14:15:00
cve
cve
CVE-2021-24415
2021-10-18 14:15:08