CVE-2021-24291: Photo Gallery < 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS)
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the galleryid, tag, albumid and id GET parameters passed to the bwgfrontenddata AJAX action (available to both unauthenticated and authenticated users)
Other sources
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the galleryid, tag, albumid and id GET parameters passed to the bwgfrontenddata AJAX action (available to both unauthenticated and authenticated users)
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24291?
CVE-2021-24291 is a vulnerability in the Photo Gallery by 10Web WordPress plugin that allows for Reflected Cross-Site Scripting (XSS) attacks.
How severe is CVE-2021-24291?
CVE-2021-24291 has a severity rating of medium (6.1).
What is the affected software version of CVE-2021-24291?
The affected software version of CVE-2021-24291 is the Photo Gallery by 10Web plugin before version 1.5.69.
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-24291?
The Common Weakness Enumeration (CWE) ID for CVE-2021-24291 is CWE-79.
How can I fix CVE-2021-24291?
To fix CVE-2021-24291, update the Photo Gallery by 10Web plugin to version 1.5.69 or later.