WordPress Plugin Vulnerabilities

Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site Scripting

Description

The plugin does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode

Proof of Concept

Affects Plugins

Plugin icon
polo-video-gallery
No known fix

References

CVE
CVE-2021-24415

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Michał Lipiński
Submitter website
https://beastiecode.com
Verified
Yes
WPVDB ID
fd312bfd-7c98-4682-877d-846442e9c6a2

Timeline

Publicly Published
2021-09-20 (about 4 years ago)
Added
2021-09-20 (about 4 years ago)
Last Updated
2022-04-08 (about 3 years ago)

Other

Published
Title
Published
2025-01-24
Title
ABC Notation <= 6.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-08
Title
OS Our Team <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-12-16
Title
Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking
Published
2025-08-22
Title
ShortcodeHub <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author_link_target Parameter
Published
2023-10-02
Title
WP Responsive header image slider <= 3.2.1 - Contributor+ Stored XSS