Description
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Document Gallery | 4.0 – ≤ 5.1.1 | — |
References
- https://wpscan.com/vulnerability/b0b97661-c671-420c-8fca-22666862b379/ exploit vdb-entry technical-description