WordPress Plugin Vulnerabilities

GRAND Flash Album Gallery < 1.67 - Reflected Cross-Site Scripting

Description

The plugin did not sanitise or escape the I parameter in the facebook.php file, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
flash-album-gallery
Fixed in 1.67

References

URL
https://seclists.org/bugtraq/2011/Nov/186

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Amir
Verified
Yes
WPVDB ID
7e79afea-3c20-40d9-9935-26626faf3906

Timeline

Publicly Published
2014-08-01 (about 11 years ago)
Added
2014-08-01 (about 11 years ago)
Last Updated
2021-08-20 (about 4 years ago)

Other

Published
Title
Published
2024-06-06
Title
Kognetiks Chatbot for WordPress < 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-20
Title
Dynamic "To Top" 3.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2024-11-08
Title
drop in image slideshow gallery <= 12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-03-23
Title
Addon Jobsearch Chat < 3.1 - Reflected Cross-Site Scripting
Published
2022-07-14
Title
WP Comments Fields < 4.1 - Admin+ Stored Cross-Site Scripting