PT-2022-25103 · WordPress · Photospace Gallery

Marco Wotschka · Published 2022-11-29 · Updated 2022-12-01 · CVE-2022-3991

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Photospace Gallery plugin for WordPress versions up to, and including, 2.3.5

Description The issue is related to Stored Cross-Site Scripting via the plugin's settings parameters saved through the update() function, due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page.

Recommendations For versions up to, and including, 2.3.5, update to a version that includes the necessary input sanitization and output escaping to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the update() function to minimize the risk of exploitation. Additionally, restrict the ability of subscribers and above to inject arbitrary web scripts in pages.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-3991

Affected Products

Photospace Gallery

References · 7

• 🔥 https://plugins.trac.wordpress.org/browser/photospace/trunk/photospace.php#L87 · Exploit
• https://osv.dev/vulnerability/CVE-2022-3991 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3991 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/51212d87-8723-4ba7-8fa4-78912a56385f?source=cve · Note
• https://wordfence.com/vulnerability-advisories-continued/#CVE-2022-3991 · Note
• https://t.me/cibsecurity/53688 · Telegram Post
• https://t.me/cvenotify/38727 · Telegram Post