CVE-2014-6315

MEDIUM 4.3 CVSS 2.0

Published: October 10, 2014
Last modified: June 17, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-79
CVSS vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback, (2) dir, or (3) extensions parameter in an addImages action to wp-admin/admin-ajax.php.

Affected products and versions

n/a n/a — Versions not specified
photo_gallery_plugin_project photo_gallery_plugin — Version 1.1.30

References

packetstormsecurity.com http://packetstormsecurity.com/files/128518/WordPress-Photo-Gallery-1.1.30-Cross-Site-Scripting.html Exploit
secunia.com http://secunia.com/advisories/61649
www.securityfocus.com http://www.securityfocus.com/archive/1/533595/100/0/threaded
www.securityfocus.com http://www.securityfocus.com/bid/70204
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/96799
plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?new=986500 Exploit
www.htbridge.com https://www.htbridge.com/advisory/HTB23232 Exploit
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References