CVE-2021-24529: Grid Gallery < 1.2.5 - Authenticated Stored Cross Site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-23 · updated 2026-06-17
Weakness: CWE-79

Description

The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability.

Affected products

Grid Gallery – Photo Image Grid Gallery: before 1.2.5 — fixed in 1.2.5

How to fix

Upgrade to a fixed version: Grid Gallery – Photo Image Grid Gallery 1.2.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/8953d931-19f9-4b73-991c-9c48db1af8b5
https://wpscan.com/vulnerability/8953d931-19f9-4b73-991c-9c48db1af8b5

Get alerted when CVE-2021-24529 or the next vulnerability affects your stack