Vulnerability Description
The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Thriveweb | Photoswipe Masonry Gallery | < 1.2.15 |
Related Weaknesses (CWE)
References
- https://wordpress.org/plugins/photoswipe-masonry/Product
- https://www.wordfence.com/blog/2022/02/stored-cross-site-scripting-vulnerabilityExploitThird Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/64624d4c-3ffb-4516-a93Third Party Advisory
- https://wordpress.org/plugins/photoswipe-masonry/Product
- https://www.wordfence.com/blog/2022/02/stored-cross-site-scripting-vulnerabilityExploitThird Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/64624d4c-3ffb-4516-a93Third Party Advisory
FAQ
What is CVE-2022-0750?
CVE-2022-0750 is a vulnerability with a CVSS score of 6.4 (MEDIUM). The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_i...
How severe is CVE-2022-0750?
CVE-2022-0750 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-0750?
Check the references section above for vendor advisories and patch information. Affected products include: Thriveweb Photoswipe Masonry Gallery.