CVE-2021-24415: Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site Scripting
The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Other sources
The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24415?
CVE-2021-24415 is a vulnerability in The Polo Video Gallery WordPress plugin version 1.2 that allows users with a low role to execute Cross-Site Scripting attacks.
What is the severity of CVE-2021-24415?
The severity of CVE-2021-24415 is medium with a CVSS score of 5.4.
How does CVE-2021-24415 impact WordPress websites?
CVE-2021-24415 can enable attackers with contributor-level roles to inject malicious code through the plugin's shortcode parameters, leading to Cross-Site Scripting attacks.
What is Cross-Site Scripting (XSS)?
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
How can CVE-2021-24415 be mitigated?
To mitigate CVE-2021-24415, it is recommended to update The Polo Video Gallery WordPress plugin to a version that addresses the vulnerability.