CVE-2023-3499: Robo Gallery < 3.2.16 - Admin+ Stored XSS
The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2023-3499.
What is the severity of CVE-2023-3499?
The severity of CVE-2023-3499 is medium with a CVSS score of 4.8.
How does the Photo Gallery Images Slider in Rbs Image Gallery WordPress plugin before 3.2.16 allow high privilege users to perform attacks?
The Photo Gallery Images Slider in Rbs Image Gallery WordPress plugin before 3.2.16 does not sanitise and escape some of its settings, allowing high privilege users to perform Stored Cross-Site Scripting (XSS) attacks.
Can high privilege users perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed?
Yes, high privilege users can perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed.
How can I fix the vulnerability in Rbs Image Gallery WordPress plugin?
To fix the vulnerability in Rbs Image Gallery WordPress plugin, update to version 3.2.16 or later.