Photo Gallery < 1.6.4 – Admin+ Stored Cross-Site Scripting | CVE 2022-1394 | Plugin Vulnerabilities

Description

The plugin does not properly validate and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed

Proof of Concept

Go to Photo Gallery > Global Settings > Watermark

Using the web browser inspector, change the input type of the "Watermark font size" and "Watermark opacity" fields from number to text, and put the following payload in them, then save: " autofocus onfocus=alert(/XSS/)//

Other settings which should be number (such as "Number of preloaded images" in the General tab) are also affected

Affects Plugins

Fixed in 1.6.4

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

0ppr2s

Submitter

dnr6419

Verified

Yes

WPVDB ID

f7a0df37-3204-4926-84ec-2204a2f22de3

Timeline

Publicly Published

2022-05-16 (about 3 years ago)

Added

2022-05-16 (about 3 years ago)

Last Updated

2022-05-17 (about 3 years ago)

Other

Published

Title

Published

2022-07-26

Title

Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting

Published

2025-04-17

Title

JetElements For Elementor < 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-07-17

Title

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) < 5.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2021-08-19

Title

Donate With QRCode < 1.4.5 - Stored Cross-Site Scripting

Published

2025-03-27

Title

The Pack Elementor addons < 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting