WordPress Image Gallery Plugin Pre-2.4.1 XSS Vulnerability Advisory

Vulnerability Overview The WordPress Image Gallery block contains a Cross-Site Scripting (XSS) vulnerability in versions prior to 2.4.1. This vulnerability allows attackers to execute arbitrary JavaScript code by crafting malicious links, which can be triggered when users visit the affected pages, potentially leading to session hijacking or other malicious activities. Scope of Impact Plugin Name: WordPress Image Gallery block – Create and display photo galleries/photo albums Affected Versions: < 2.4.1 Plugin Type: WordPress Plugin Release Date: January 2, 2024 Discoverer: Rakesh Kumar Report Date: January 2, 2024 Disclosure Date: January 2, 2024 Remediation Update to Version 2.4.1 or Later: Users are strongly advised to immediately update the plugin to the latest version to mitigate this vulnerability. Automatic Updates: If automatic updates are enabled, the plugin will automatically update to the latest version. POC or Exploit Code No specific Proof of Concept (POC) code or exploit code is provided on the page. Additional Information Risk Level: Low CVSS Score: 5.4 Solution Status: Patch Available Timeline: - Report Date: January 2, 2024 - Disclosure Date: January 2, 2024 - Patch Release Date: January 2, 2024 Contact Information Reporter: Rakesh Kumar Contact Method: Via the Patchstack platform Subscription Service Subscription Method: Enter your email address to subscribe to Patchstack's security intelligence updates. Disclaimer Disclaimer: The information provided on this page is for informational purposes only and does not constitute legal advice or any guarantee. Footer Information Copyright: © 2024 Patchstack Privacy Policy: Link to the Privacy Policy page Terms and Conditions: Link to the Terms and Conditions page Contact Us: Link to the Contact Us page

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Image Gallery Plugin Pre-2.4.1 XSS Vulnerability Advisory

More from this source