CVE-2021-24357: FooGallery < 2.0.35 - Authenticated Stored Cross-Site Scripting
In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue.
Other sources
In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24357?
CVE-2021-24357 is a vulnerability in the Best Image Gallery & Responsive Photo Gallery - FooGallery WordPress plugin before version 2.0.35 that allows for a stored Cross-Site Scripting (XSS) issue due to improper sanitization or validation of the Custom CSS field in each gallery.
How does CVE-2021-24357 impact WordPress websites using the FooGallery plugin?
WordPress websites using the FooGallery plugin before version 2.0.35 are affected by CVE-2021-24357, which can lead to a stored Cross-Site Scripting (XSS) vulnerability.
What is the severity of CVE-2021-24357?
CVE-2021-24357 has a severity rating of medium with a CVSS score of 5.4.
How can I fix CVE-2021-24357 in the FooGallery WordPress plugin?
To fix CVE-2021-24357, it is recommended to update the FooGallery WordPress plugin to version 2.0.35 or above, which includes the proper sanitization and validation of the Custom CSS field.
Where can I find more information about CVE-2021-24357?
You can find more information about CVE-2021-24357 at the following reference link: [CVE-2021-24357 Reference](https://wpscan.com/vulnerability/950f46ae-4476-4969-863a-0e55752953b3)