CVE-2015-10128

LOW

royal_prettyphoto < 1.3 - Cross-Site Scripting in royal_prettyphoto_plugin_links Function

Title source: llm

Description

A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royal_prettyphoto_plugin_links of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3 is able to address this issue. The patch is identified as 0d3d38cfa487481b66869e4212df1cefc281ecb7. It is recommended to upgrade the affected component. VDB-249422 is the identifier assigned to this vulnerability.

References (3)

Core 3

Core References

Third Party Advisory vdb-entry technical-description

https://vuldb.com/?id.249422

Third Party Advisory signature permissions-required

https://vuldb.com/?ctiid.249422

Patch patch

https://github.com/wp-plugins/rt-prettyphoto/commit/0d3d38cfa487481b66869e4212df1cefc281ecb7

View Patch ZIP pw:eip

Scores

CVSS v3 3.5

EPSS 0.0046

EPSS Percentile 37.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (1)

royaltechbd/royal_prettyphoto < 1.3

Published Jan 02, 2024

Tracked Since Feb 18, 2026