WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler
Vulnerability Description
The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-29833
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- AppCheck Ltd.
References
More from 10Web
View All →Affected Vendor
10Web
View all reports →