CVE-2021-24882: Slideshow Gallery < 1.7.4 - Admin+ Stored Cross-Site Scripting
The Slideshow Gallery WordPress plugin before 1.7.4 does not sanitise and escape the Slide "Title", "Description", and Gallery "Title" fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24882?
CVE-2021-24882 is a vulnerability found in the Slideshow Gallery WordPress plugin before version 1.7.4.
What is the severity of CVE-2021-24882?
The severity of CVE-2021-24882 is medium, with a CVSS score of 4.8.
How does CVE-2021-24882 affect the Slideshow Gallery WordPress plugin?
CVE-2021-24882 affects the Slideshow Gallery WordPress plugin by not properly sanitizing and escaping the Slide Title, Description, and Gallery Title fields, which can lead to Cross-Site Scripting attacks.
Which version of the Slideshow Gallery WordPress plugin is affected by CVE-2021-24882?
The Slideshow Gallery WordPress plugin versions before 1.7.4 are affected by CVE-2021-24882.
How can I mitigate the CVE-2021-24882 vulnerability?
To mitigate the CVE-2021-24882 vulnerability, it is recommended to update the Slideshow Gallery WordPress plugin to version 1.7.4 or later.