PT-2022-9499 · WordPress · Grand Flagallery

Tyler Miller · Published 2022-02-28 · Updated 2022-03-07 · CVE-2021-24903

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GRAND FlaGallery WordPress plugin versions 6.1.2 and earlier

Description The issue concerns the lack of proper sanitization and escaping of certain gallery settings, potentially allowing high-privilege users to perform Cross-Site scripting attacks, even when the unfiltered html capability is disallowed.

Recommendations For GRAND FlaGallery WordPress plugin versions 6.1.2 and earlier, update to a version that properly sanitizes and escapes gallery settings to prevent Cross-Site scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24903

Affected Products

Grand Flagallery

References · 4

• 🔥 https://wpscan.com/vulnerability/ad67e45e-254a-46ce-a243-bfc86839446e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24903 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24903 · Vendor Advisory
• https://t.me/cvenotify/27837 · Telegram Post