Smooth Gallery Replacement WordPress Plugin Cross-Site Scripting Vulnerability
Vulnerability
A vulnerability in the Smooth Gallery Replacement WordPress plugin, affecting versions through 1.0, allows for Cross-Site Scripting (XSS) attacks. The plugin lacks proper Cross-Site Request Forgery (CSRF) protections in certain areas and fails to adequately sanitize and escape user input. This combination could enable attackers to exploit logged-in administrators by injecting stored XSS payloads through a CSRF attack.
Impact
Exploitation of this vulnerability allows for authenticated users with contributor privileges or higher to inject malicious scripts that are stored and executed in the context of the user.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.