WordPress Plugin Vulnerabilities

NextGEN Gallery < 3.59.3 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

The PoC will be displayed on July 06, 2024, to give users the time to update.

Affects Plugins

Plugin icon
nextgen-gallery
Fixed in 3.59.3

References

CVE
CVE-2024-5442
URL
https://research.cleantalk.org/CVE-2024-5442/

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79

Miscellaneous

Original Researcher
Krugov Artyom
Submitter
Krugov Aryom
Submitter website
https://research.cleantalk.org
Verified
Yes
WPVDB ID
4f1fa417-f760-4132-95c2-a38d0b631263

Timeline

Publicly Published
2024-06-22 (about 9 days ago)
Added
2024-06-22 (about 9 days ago)
Last Updated
2024-06-22 (about 9 days ago)

Other

Published
Title
Published
2024-05-07
Title
Custom Field Suite < 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2024-01-16
Title
SimpleMap Store Locator <= 2.6.1 - Unauthenticated Stored Cross-Site Scripting
Published
2023-09-01
Title
Font Awesome 4 Menus <= 4.7.0 - Contributor+ Stored XSS
Published
2024-03-29
Title
Ultimate Addons for Beaver Builder – Lite < 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget
Published
2023-02-20
Title
WordPress Custom Settings <= 1.0 - Admin+ Stored XSS