PT-2023-21887 · WordPress · Inpost Gallery

Published 2023-03-22 · Updated 2023-03-28 · CVE-2023-28666

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions InPost Gallery WordPress plugin versions prior to 2.2.2

Description The issue is a reflected cross-site scripting vulnerability. It affects the imgurl parameter to the add inpost gallery slide item action and can only be triggered by an authenticated user.

Recommendations For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the add inpost gallery slide item action to minimize the risk of exploitation. Avoid using the imgurl parameter in the affected action until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-28666

Affected Products

Inpost Gallery

References · 4

• 🔥 https://tenable.com/security/research/tra-2023-3 · Exploit
• https://osv.dev/vulnerability/CVE-2023-28666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28666 · Security Note
• https://t.me/cibsecurity/60520 · Telegram Post