CVE-2021-24515: Video Gallery - Vimeo and YouTube Gallery < 1.1.5 - Admin+ Stored Cross-Site Scripting

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-10-25 · updated 2026-06-17
Weakness: CWE-79

Description

The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues

Affected products

Video Gallery - Vimeo and YouTube Gallery: before 1.1.5 — fixed in 1.1.5

How to fix

Upgrade to a fixed version: Video Gallery - Vimeo and YouTube Gallery 1.1.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/6bbea7fe-e966-406b-ad06-0206fcc6f0a0
https://wpscan.com/vulnerability/6bbea7fe-e966-406b-ad06-0206fcc6f0a0

Get alerted when CVE-2021-24515 or the next vulnerability affects your stack