WordPress Plugin Vulnerabilities

Simple Image Gallery <= 1.0.6 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the ~/simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.

Affects Plugins

Plugin icon
simple-responsive-image-gallery
No known fix

References

CVE
CVE-2021-39313
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39313

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.5 (high)

Miscellaneous

Original Researcher
p7e4
Verified
Yes
WPVDB ID
fb0cd3f1-57b2-4409-b96c-81a078c88f19

Timeline

Publicly Published
2021-12-14 (about 4 years ago)
Added
2021-12-15 (about 4 years ago)
Last Updated
2022-04-12 (about 3 years ago)

Other

Published
Title
Published
2022-06-01
Title
Easy SVG Support < 3.3.0 - Author+ Stored Cross Site Scripting via SVG
Published
2023-01-25
Title
Auto Hide Admin Bar < 1.6.2 - Admin+ Stored XSS
Published
2024-12-19
Title
Embed Twine <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-10-31
Title
Super Addons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2014-08-01
Title
ABC Test - "id" Cross-Site Scripting