CVE-2021-25115
WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)
MEDIUM 6.4EPSS 0.7%
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
- Affected
- WP Photo Album Plus
- CVSS v3.1 NVD
- 6.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 3.5 LOW
AV:N/AC:M/Au:S/C:N/I:P/A:N - EPSS
- 0.68% chance of exploitation in the next 30 days, 52nd percentile
- Published
- 2022-02-14
- Updated
- 2024-08-03