CVE-2024-1487 – Photos and Files Contest Gallery < 21.3.1 - Author+ Stored Cross Site Scripting

https://notcve.org/view.php?id=CVE-2024-1487

The Photos and Files Contest Gallery WordPress plugin before 21.3.1 does not sanitize and escape some parameters, which could allow users with a role as low as author to perform Cross-Site Scripting attacks. El complemento de WordPress de Photos and Files Contest Gallery anterior a 21.3.1 no sanitiza ni escapa a algunos parámetros, lo que podría permitir a los usuarios con un rol tan bajo como el de autor realizar ataques de Cross-Site Scripting. The Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 21.3.0 due to insufficient input sanitization and output escaping on content descriptions. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/c028cd73-f30a-4c8b-870f-3071055f0496 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •