CVE-2021-47929

WordPress Plugin Filterable Portfolio Gallery 1.0 Stored XSS

CVSS 5.1 MEDIUMEPSS 0.2%CWE-79

Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Attackers can store JavaScript code like image tags with onerror handlers that execute when the gallery is previewed, affecting all users viewing the page.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected products

Filterable-Portfolio · Filterable Portfolio Gallery

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/50458unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wordpress.org/plugins/fg-gallery/https://www.exploit-db.com/exploits/50458 https://www.vulncheck.com/advisories/wordpress-plugin-filterable-portfolio-gallery-stored-xss http://www.filterable-portfolio.com/