Envira Gallery Lite < 1.8.3.3 – Authenticated Stored Cross-Site Scripting | CVE 2021-24126 | Plugin Vulnerabilities

Description

The plugin does not properly sanitise the images metadata (namely title) before outputting them in the generated gallery. This allows privileged accounts such as editor+ to perform XSS attacks (even without the unfiltered_html capability) against users visiting the gallery in the frontend.

Proof of Concept

As an editor+, add an image to a gallery and set its title (via the metadata) to <img src onerror=alert(/XSS/)>. Then view a page where the gallery is embed.

https://drive.google.com/open?id=1G15mMK4mLFV5VUL_vWxpbbBDworjciiM

Affects Plugins

envira-gallery-lite

Fixed in 1.8.3.3

References

CVE

URL

https://plugins.trac.wordpress.org/changeset/2442591

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

minhtuanact

Submitter

SunCSR (Sun Cyber Security Research)

Submitter website

http://research.sun-asterisk.com/

Submitter twitter

https://twitter.com/tuanbgpro97

Verified

Yes

WPVDB ID

f3952bd1-ac2f-4007-9e19-6c44a22465f3

Timeline

Publicly Published

2020-12-19 (about 5 years ago)

Added

2020-12-19 (about 5 years ago)

Last Updated

2021-01-20 (about 4 years ago)

Other

Published

Title

Published

2025-02-11

Title

Admire Extra < 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-01-27

Title

Tube Video Ads Lite <= 1.5.7 - Reflected XSS

Published

2025-07-04

Title

Video Gallery Block < 1.1.1 - Contributor+ Stored XSS

Published

2024-01-03

Title

Ads Invalid Click Protection <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published

2022-06-14

Title

Custom Popup Builder <= 1.3.1 - Contributor+ Stored Cross-Site Scripting