What’s Vulnerable › Vulnerabilities

CVE-2024-29809: WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_url

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-26 · updated 2026-06-17
• Weakness: CWE-79

Description

The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

Affected products

• 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery: before 1.8.22 — fixed in 1.8.22

How to fix

Upgrade to a fixed version: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery 1.8.22. Check the vendor advisory for mitigations.

References

• https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/
• https://wordpress.org/plugins/photo-gallery/#developers
• https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/
• https://wordpress.org/plugins/photo-gallery/#developers

Get alerted when CVE-2024-29809 or the next vulnerability affects your stack