CyberRota Analysis
AI-GeneratedThe Photo Gallery by 10Web WordPress plugin prior to version 1.8.44 is vulnerable due to insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary JavaScript into the admin pages. This can lead to session hijacking or other malicious actions when a logged-in administrator or contributor interacts with a crafted link. WordPress site administrators using this plugin should prioritize immediate updates to mitigate potential exploitation.
Original NVD Description
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install).