PT-2022-9670 · WordPress · Wp Photo Album Plus

Krzysztof Zając · Published 2022-02-14 · Updated 2022-02-19 · CVE-2021-25115

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 8.0.10

Description The issue concerns Stored Cross-Site Scripting (XSS) due to improper handling of error log content. This allows any user, including unauthenticated ones, to execute arbitrary JavaScript in the admin panel.

Recommendations For versions prior to 8.0.10, update to version 8.0.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin panel to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25115

Affected Products

Wp Photo Album Plus

References · 5

• 🔥 https://wpscan.com/vulnerability/dbc18c2c-7547-44fc-8a41-c819757e47a7 · Exploit
• https://osv.dev/vulnerability/CVE-2021-25115 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2655859/wp-photo-album-plus · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25115 · Security Note
• https://t.me/cibsecurity/37408 · Telegram Post