CVE-2024-29809: falha de média gravidade em 10Web PhotoGallery
WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_url
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.4%
The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
10Web · PhotoGalleryCVEs relacionadas — 10Web PhotoGallery
No mesmo produto, das mais perigosas para as menos.
CVE-2024-29832MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current_urlEPSS 0.4%CVE-2024-29833MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandlerEPSS 0.4%CVE-2024-29810MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg thumb_urlEPSS 0.4%CVE-2024-29808MEDIUMWordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_idEPSS 0.4%