CVE-2022-0750: Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scripting
The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnailwidth, thumbnailheight, maximagewidth, and maximageheight parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0750?
CVE-2022-0750 is a vulnerability found in the Photoswipe Masonry Gallery WordPress plugin that allows for Cross-Site Scripting attacks.
How does CVE-2022-0750 work?
CVE-2022-0750 works by not properly escaping and sanitizing certain parameters in the ~/photoswipe-masonry.php file, which can be exploited for Cross-Site Scripting.
What is the severity of CVE-2022-0750?
The severity of CVE-2022-0750 is medium with a CVSS score of 6.4.
Which software versions are affected by CVE-2022-0750?
Versions up to and including 1.2.14 of the Thriveweb Photoswipe Masonry Gallery WordPress plugin are affected by CVE-2022-0750.
How can I fix CVE-2022-0750?
To fix CVE-2022-0750, update the Thriveweb Photoswipe Masonry Gallery plugin to version 1.2.15 or newer.