CVE-2021-24415

Опубликовано: 18 окт. 2021

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode

Ссылки

https://wpscan.com/vulnerability/fd312bfd-7c98-4682-877d-846442e9c6a2
Third Party Advisory
https://wpscan.com/vulnerability/fd312bfd-7c98-4682-877d-846442e9c6a2
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bplugins:polo_video_gallery:*:*:*:*:*:wordpress:*:*

Версия до 1.2 (включая)

EPSS

Процентиль: 40%

0.0018

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-3cv4-wq55-4fr6

github

больше 3 лет назад

The Polo Video Gallery â€“ Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode