The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
References
Configurations
History
21 Nov 2024, 06:39
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 6.4 |
| References | () https://wordpress.org/plugins/photoswipe-masonry/ - Product | |
| References | () https://www.wordfence.com/blog/2022/02/stored-cross-site-scripting-vulnerability-patched-in-a-wordpress-photo-gallery-plugin/ - Exploit, Third Party Advisory | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/64624d4c-3ffb-4516-a938-0accde24c79f?source=cve - Third Party Advisory |
24 Oct 2023, 20:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/64624d4c-3ffb-4516-a938-0accde24c79f?source=cve - Third Party Advisory | |
| References | (MISC) https://wordpress.org/plugins/photoswipe-masonry/ - Product |
20 Oct 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14. |
Information
Published : 2022-03-23 20:15
Updated : 2024-11-21 06:39
NVD link : CVE-2022-0750
Mitre link : CVE-2022-0750
CVE.ORG link : CVE-2022-0750
JSON object : View
Products Affected
thriveweb
- photoswipe_masonry_gallery
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')