CVE-2022-0750: XSS
First published: Wed Mar 23 2022(Updated: )
The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
Credit: security@wordfence.com security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Thriveweb Photoswipe Masonry Gallery | <=1.2.14 | |
| Thriveweb Photoswipe Masonry Gallery | <1.2.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-0750?
CVE-2022-0750 is a vulnerability found in the Photoswipe Masonry Gallery WordPress plugin that allows for Cross-Site Scripting attacks.
How does CVE-2022-0750 work?
CVE-2022-0750 works by not properly escaping and sanitizing certain parameters in the ~/photoswipe-masonry.php file, which can be exploited for Cross-Site Scripting.
What is the severity of CVE-2022-0750?
The severity of CVE-2022-0750 is medium with a CVSS score of 6.4.
Which software versions are affected by CVE-2022-0750?
Versions up to and including 1.2.14 of the Thriveweb Photoswipe Masonry Gallery WordPress plugin are affected by CVE-2022-0750.
How can I fix CVE-2022-0750?
To fix CVE-2022-0750, update the Thriveweb Photoswipe Masonry Gallery plugin to version 1.2.15 or newer.
- collector/nvd-index
- collector/nvd-api
- agent/author
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/tags
- agent/description
- agent/source
- vendor/thriveweb
- canonical/thriveweb photoswipe masonry gallery
- version/thriveweb photoswipe masonry gallery/1.2.14