CVE-2022-0750mediumCWE-79

CVE-2022-0750: fallo de gravedad media en deanoakley Photoswipe Masonry Gallery

Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scripting

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Photoswipe Masonry Gallery

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.4epss 4.4%
The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Productos afectados
deanoakley · Photoswipe Masonry Gallery