CVE-2015-2324
MEDIUM10web Photo Gallery < 1.2.13 - Authenticated Stored Cross-Site Scripting in Filemanager
Title source: llmDescription
Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors.
References (2)
Core 2
Core References
Product, Release Notes x_refsource_confirm
https://github.com/wp-plugins/photo-gallery/blob/master/readme.txt
Third Party Advisory x_refsource_misc
https://fortiguard.com/zeroday/FG-VD-15-009
Scores
CVSS v3
5.4
EPSS
0.0087
EPSS Percentile
55.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
10web/photo_gallery
< 1.2.13
Published
Feb 19, 2018
Tracked Since
Feb 18, 2026