PT-2021-15671 · WordPress · Envira Gallery Lite

Minhtuanact · Published 2021-03-18 · Updated 2021-03-24 · CVE-2021-24126

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Envira Gallery Lite WordPress plugin versions prior to 1.8.3.3

Description: The issue is related to unvalidated input and lack of output encoding, which could lead to privilege escalation. Specifically, the images metadata, namely the title, was not properly sanitised before being outputted in the generated gallery.

Recommendations: For versions prior to 1.8.3.3, update to version 1.8.3.3 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24126

Affected Products

Envira Gallery Lite

References · 3

• 🔥 https://wpscan.com/vulnerability/f3952bd1-ac2f-4007-9e19-6c44a22465f3 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24126 · Security Note