Photo Gallery < 1.8.3 – Stored XSS via CSRF | CVE 2022-4058 | Plugin Vulnerabilities

Description

The plugin does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.

Note: The XSS will only trigger for the attacked user and be reset when they logout

Proof of Concept

Make a logged in admin open one of the below URL:

https://example.com/wp-admin/admin-ajax.php?action=addMusic&sort_by=%22;alert(/XSS/);%22
https://example.com/wp-admin/admin-ajax.php?action=addMusic&sort_by=size&sort_order=%22;alert(/XSS-order/);%22

Even though the request above will result in a "Sorry, your nonce did not verify." error, the XSS payload will trigger when an admin attempts to add a new image to a gallery.

Affects Plugins

Fixed in 1.8.3

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Submitter twitter

Verified

Yes

WPVDB ID

89656cb3-4611-4ae7-b7f8-1b22eb75cfc4

Timeline

Publicly Published

2022-11-28 (about 3 years ago)

Added

2022-11-28 (about 3 years ago)

Last Updated

2022-11-28 (about 3 years ago)

Other

Published

Title

Published

2023-11-24

Title

Community by PeepSo < 6.2.7.0 - Reflected Cross-Site Scripting

Published

2024-10-24

Title

Textboxes <= 0.1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-02-28

Title

Page Builder by SiteOrigin < 2.31.5 - Contributor+ Stored XSS

Published

2025-03-27

Title

Google Font Fix <= 2.3.1 - Reflected Cross-Site Scripting

Published

2013-08-23

Title

VideoWhisper Live Streaming Integration < 4.67.17 - Reflected Cross-Site Scripting (XSS)