WordPress CVEs

Description

Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected WordPress components

• Ibtana – WordPress Website Builder Plugin · ibtana-visual-editor
  Confirmed match Active
  Up to and including 1.2.5.1
  View on WordPress.org
• Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) Plugin · image-hover-effects-ultimate
  Confirmed match Active
  Up to and including 9.10.5
  View on WordPress.org
• Royal Addons for Elementor – Addons and Templates Kit for Elementor Plugin · royal-elementor-addons
  Confirmed match Active
  Up to and including 1.7.1031
  View on WordPress.org
• OnePress Theme · onepress
  Confirmed match Active
  Up to and including 2.3.16
  View on WordPress.org
• Gallery with thumbnail slider Plugin · gallery-with-thumbnail-slider
  Possible match Active
  Up to and including 7.8
  View on WordPress.org
• TP WooCommerce Product Gallery Plugin · tp-woocommerce-product-gallery
  Possible match Active
  Up to and including 1.1.9
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• lightgalleryteam LightGallery WP — Up to and including 1.0.5
• tplugins TP WooCommerce Product Gallery — Up to and including 1.1.9
• vowelweb Ibtana – WordPress Website Builder — Up to and including 1.2.5.1
• wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor — Up to and including 1.7.1031
• wpsofts Portfolio, Gallery, Product Catalog – Grid KIT Portfolio — Up to and including 2.2.1
• famethemes OnePress — Up to and including 2.3.16
• galaxyweblinks Gallery with thumbnail slider — Up to and including 7.8
• oxilab Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) — Up to and including 9.10.5

References

• github.com https://github.com/sachinchoolur/lightGallery
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3311382/
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3343557/
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3356089/
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3372141/
• themes.trac.wordpress.org https://themes.trac.wordpress.org/changeset/299860
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/acaa3142-2bbc-43d3-8ecc-05e8edb931ec?source=cve
• nvd.nist.gov Official NVD record