CVE-2023-28666: XSS
First published: Wed Mar 22 2023(Updated: )
The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' parameter to the add_inpost_gallery_slide_item action, which can only be triggered by an authenticated user.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pluginus Inpost Gallery | <=2.1.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-28666?
CVE-2023-28666 is a vulnerability in the InPost Gallery WordPress plugin, versions < 2.2.2, that allows for reflected cross-site scripting.
How does CVE-2023-28666 affect the InPost Gallery WordPress plugin?
CVE-2023-28666 affects the InPost Gallery WordPress plugin by allowing an authenticated user to exploit a reflected cross-site scripting vulnerability.
What is the severity of CVE-2023-28666?
CVE-2023-28666 has a severity rating of medium (5.4).
Which version of the InPost Gallery WordPress plugin is affected by CVE-2023-28666?
Versions of the InPost Gallery WordPress plugin prior to 2.2.2 are affected by CVE-2023-28666.
How can I fix CVE-2023-28666?
To fix CVE-2023-28666, update the InPost Gallery WordPress plugin to version 2.2.2 or higher.
- collector/nvd-index
- agent/weakness
- vendor/pluginus
- canonical/pluginus inpost gallery
- version/pluginus inpost gallery/2.1.4.1