PT-2020-6780 · WordPress · Envira Photo Gallery

Published 2020-02-13 · Updated 2023-05-23 · CVE-2020-9334

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Envira Photo Gallery plugin through 1.7.6 for WordPress

Description A stored XSS issue exists due to inadequate protection of the webpage structure. This allows a remote attacker to perform cross-site scripting attacks. Successful exploitation would enable an authenticated low-privileged user to inject arbitrary JavaScript code viewed by other users.

Recommendations For Envira Photo Gallery plugin versions through 1.7.6, update to a version later than 1.7.6 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-06374

CVE-2020-9334

Affected Products

Envira Photo Gallery

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-9334 · Security Note
• https://bdu.fstec.ru/vul/2022-06374 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9334 · Vendor Advisory
• https://fortiguard.com/zeroday/FG-VD-20-042 · Note
• https://t.me/cvenotify/1219 · Telegram Post
• https://wpvulndb.com/vulnerabilities/10089 · Note
• https://wordpress.org/plugins/envira-gallery-lite/#developers · Note