PT-2021-15830 · 10Web · The Photo Gallery

Thuramoemyint · Published 2021-05-14 · Updated 2025-10-29 · CVE-2021-24291

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin versions prior to 1.5.69

Description The issue concerns Reflected Cross-Site Scripting (XSS) problems. The vulnerability can be exploited via the gallery id, tag, album id, and id GET parameters passed to the "bwg frontend data" AJAX action. This action is accessible to both unauthenticated and authenticated users.

Recommendations For versions prior to 1.5.69, update to version 1.5.69 or later to resolve the issue. As a temporary workaround, consider restricting access to the "bwg frontend data" AJAX action to minimize the risk of exploitation. Avoid using the gallery id, tag, album id, and id parameters in the affected AJAX endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24291

Affected Products

The Photo Gallery

References · 5

• 🔥 https://packetstormsecurity.com/files/162227 · Exploit
• 🔥 https://wpscan.com/vulnerability/cfb982b2-8b6d-4345-b3ab-3d2b130b873a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24291 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24291 · Vendor Advisory
• https://t.me/cveNotify/140802 · Telegram Post