medium5.4
CVE-2024-29810
The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting.
Impact
The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| 10web | Photo Gallery | before 1.8.22 |
Weakness classification
References
- NVD record
- CVE.org record
- https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/
- https://wordpress.org/plugins/photo-gallery/#developers
- https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/
- https://wordpress.org/plugins/photo-gallery/#developers