NextCellent Gallery <= 1.9.35 – Admin+ Stored XSS | CVE 2022-1971 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

Create/edit a gallery with at least one image, put the following payload in the "Alt & Title Text" field: State of Mind"autofocus onfocus=alert(/XSS/)//

Save the changes (via the button next to the Apply button). The XSS will be triggered when editing the Gallery again

Affects Plugins

nextcellent-gallery-nextgen-legacy

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

lucy

Submitter

lucy

Verified

Yes

WPVDB ID

1bffbbef-7876-43a6-9cb0-6e09bb4ff2b0

Timeline

Publicly Published

2022-06-06 (about 3 years ago)

Added

2022-06-06 (about 3 years ago)

Last Updated

2023-03-09 (about 2 years ago)

Other

Published

Title

Published

2024-08-22

Title

Giveaways and Contests by RafflePress < 1.12.16 - Editor+ Stored XSS

Published

2023-05-09

Title

VK Blocks < 1.54.0 - Multiple Stored XSS

Published

2023-02-15

Title

Eyes Only: User Access Shortcode <= 1.8.2 - Admin+ Stored XSS

Published

2022-05-26

Title

Hotel Booking < 3.3 - Contributor+ Stored XSS

Published

2024-02-09

Title

Brooklyn <= 4.9.7.6 - Reflected Cross-Site Scripting