PT-2022-9646 · WordPress · The Portfolio Gallery

Krzysztof Zając · Published 2022-04-11 · Updated 2022-04-15 · CVE-2021-25090

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Portfolio Gallery, Product Catalog WordPress plugin versions prior to 2.1.0

Description The issue concerns a lack of authorization and CSRF checks in various functions related to AJAX actions, allowing any authenticated users to call them. This also leads to a potential for Cross-Site Scripting attacks on pages where a Portfolio is embedded, due to insufficient sanitization and escaping.

Recommendations For versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to AJAX actions related to the Portfolio Gallery plugin to minimize the risk of exploitation. Avoid using the plugin's vulnerable functions until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25090

Affected Products

The Portfolio Gallery

References · 4

• 🔥 https://wpscan.com/vulnerability/32a4a2b5-ef65-4e29-af4a-f003dbd0809c · Exploit
• https://osv.dev/vulnerability/CVE-2021-25090 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25090 · Security Note
• https://t.me/cibsecurity/40470 · Telegram Post