CVE-2024-29808: WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_id
The imageid parameter of the AJAX call to the editimagebwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the imageid parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29808?
CVE-2024-29808 is considered a medium severity vulnerability due to the potential for reflected Cross Site Scripting attacks.
How do I fix CVE-2024-29808?
To fix CVE-2024-29808, update the WordPress Photo Gallery Plugin to version 1.8.22 or later.
What software is affected by CVE-2024-29808?
CVE-2024-29808 affects the WordPress Photo Gallery Plugin version up to and including 1.8.21.
What kind of attack can be carried out using CVE-2024-29808?
CVE-2024-29808 allows attackers to execute arbitrary JavaScript within a user's browser through reflected Cross Site Scripting.
Is there a workaround for CVE-2024-29808?
A temporary workaround for CVE-2024-29808 is to disable the AJAX functionality of the affected plugin until a patch is applied.