CVE-2021-24126
Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting
MEDIUM 5.4EPSS 0.7%
Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata (namely title) before outputting them in the generated gallery, which could lead to privilege escalation.
- Affected
- Envira Gallery Lite
- CVSS v3.1 NVD
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 3.5 LOW
AV:N/AC:M/Au:S/C:N/I:P/A:N - EPSS
- 0.66% chance of exploitation in the next 30 days, 51st percentile
- Published
- 2021-03-18
- Updated
- 2024-08-03