Photos and Files Contest Gallery – Contact Form < 21.2.8.1 – Unauthenticated Stored XSS via HTTP Headers | CVE 2023-5307 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.

Proof of Concept

1. Use a proxy such as BurpSuite to add the following header to all requests:

X-Forwarded-For: 11.11.11.11<img src=x onerror=alert(1)>

2. Create a gallery and add its shortcode to a page.
3. As an unauthenticated user, upload an image to the gallery from the frontend.
4. As an administrator, click on "Contest Gallery" in the sidebar and click "Edit Gallery" on the gallery entry to trigger the XSS.

Affects Plugins

contest-gallery

Fixed in 21.2.8.1

References

CVE

URL

https://research.cleantalk.org/cve-2023-5307-photos-and-files-contest-gallery-contact-form-21-2-8-1-unauthenticated-stored-xss-via-http-headers

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://blog.cleantalk.org

Verified

Yes

WPVDB ID

6fac1e09-21ab-430d-b56d-195e7238c08c

Timeline

Publicly Published

2023-10-09 (about 2 years ago)

Added

2023-10-09 (about 2 years ago)

Last Updated

2023-10-10 (about 2 years ago)

Other

Published

Title

Published

2025-09-22

Title

Double the Donation < 3.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2025-02-20

Title

TCBD Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-10-21

Title

uCAT – Next Story <= 2.0.0 - Reflected Cross-Site Scripting

Published

2024-10-24

Title

Post Grid and Gutenberg Blocks < 2.2.94 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-10-08

Title

CMSMasters Content Composer < 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode