CVE-2024-29810: WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg thumb_url
The thumburl parameter of the AJAX call to the editimagebwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumburl parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29810?
CVE-2024-29810 is classified as a medium severity reflected Cross Site Scripting vulnerability.
How do I fix CVE-2024-29810?
To fix CVE-2024-29810, update the WordPress Photo Gallery Plugin to version 1.8.22 or higher.
Which software is affected by CVE-2024-29810?
CVE-2024-29810 affects the WordPress Photo Gallery Plugin versions up to and including 1.8.21.
What impact does CVE-2024-29810 have on my website?
Exploiting CVE-2024-29810 can allow an attacker to inject arbitrary JavaScript into the user's browser, potentially leading to data theft or site defacement.
Is there a workaround for CVE-2024-29810?
As a temporary workaround for CVE-2024-29810, you can disable AJAX calls to the editimage_bwg action until a patch is applied.