Photo Gallery by 10Web <= 1.8.27 – Admin+ Stored XSS | CVE 2024-5968 | Plugin Vulnerabilities

Description

The plugin does not properly sanitise and escape some of its Gallery settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Proof of Concept

As admin, create/edit a gallery, add/edit an image, set the following payload in the "Alt/Title" field and save: &lt;img src=x onerror=alert(/XSS/)&gt;

The XSS will be triggered in page/post where the Gallery is embed, or by previewing it

Affects Plugins

Fixed in 1.8.28

References

CVE

URL

https://research.cleantalk.org/cve-2024-5968/

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Dmitrii Ignatyev

Submitter

Dmitrii Ignatyev

Submitter website

https://www.linkedin.com/in/dmitriy-ignatyev-8a9189267/

Verified

Yes

WPVDB ID

db73e8d8-feb1-4daa-937e-a73969a93bcc

Timeline

Publicly Published

2024-09-18 (about 1 year ago)

Added

2024-09-18 (about 1 year ago)

Last Updated

2024-10-17 (about 1 year ago)

Other

Published

Title

Published

2021-06-25

Title

Event Espresso Core < 4.10.7.p - Reflected Cross-Site Scripting (XSS)

Published

2023-11-23

Title

TriPay Payment Gateway < 3.2.8 - Admin+ Stored XSS

Published

2024-10-15

Title

Locatoraid Store Locator < 3.9.48 - Reflected Cross-Site Scripting

Published

2021-10-14

Title

Business Manager < 1.4.6 - Admin+ Stored Cross-Site Scripting

Published

2025-07-17

Title

Alike - WordPress Custom Post Comparison <= 3.0.1 - Reflected Cross-Site Scripting