CVE-2021-24293 | BDVDB-2026-153152 Detail

NextGen Gallery Pro

Description#

In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://wpscan.com/vulnerability/5e1a4725-3d20-44b0-8a35-bbf4263957f7
https://www.imagely.com/wordpress-gallery-plugin/nextgen-pro/changelog/

Exploit#

No public exploit known

History#

Version 12021-05-05Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.