WordPress CVEs

Description

The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role.

Affected WordPress components

• Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress Plugin · gallery-plugin
  Confirmed match Active
  Before 4.7.0
  View on WordPress.org
• gallery Plugin · gallery
  Possible match Homeless
  Before 4.7.0
  View on WordPress.org
• gallery Theme · gallery
  Possible match Homeless
  Before 4.7.0
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Gallery by BestWebSoft — Before 4.7.0
• bestwebsoft gallery — Before 4.7.0

References

• wpscan.com https://wpscan.com/vulnerability/d48c6c50-3734-4191-9833-0d9b09b1bd8a Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record