CVE-2022-3991

MEDIO 5.4CVE-2022-3991 · Published 29/11/2022 · updated 17/06/2026

In breve

CVE-2022-3991 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda photospace gallery (photospace gallery project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.69%, superiore al 53.2% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
photospace gallery photospace_gallery_project	`≤ 2.3.5`	No fix yet

Description

The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

plugins.trac.wordpress.org/browser/photospace/trunk/photospace.php · Exploit
wordfence.com/threat-intel/vulnerabilities/id/51212d87-8723-4ba7-8fa4-78912a56385f
wordfence.com/vulnerability-advisories-continued · Third Party Advisory

Altre vulnerabilità di photospace gallery

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free