What’s Vulnerable › Vulnerabilities

CVE-2024-29832: WordPress Photo Gallery Plugin <= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current_url

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-03-26 · updated 2026-06-17
• Weakness: CWE-79

Description

The current_url parameter of the AJAX call to the GalleryBox action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the current_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. No authentication is required to exploit this issue. Note that other parameters within a AJAX call, such as image_id, must be valid for this vulnerability to be successfully exploited.

Affected products

• 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery: before 1.8.22 — fixed in 1.8.22

How to fix

Upgrade to a fixed version: 10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery 1.8.22. Check the vendor advisory for mitigations.

References

• https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/
• https://wordpress.org/plugins/photo-gallery/#developers
• https://appcheck-ng.com/xss-vulnerabilities-discovered-10web-photogallery-wordpress-plugin/
• https://wordpress.org/plugins/photo-gallery/#developers

Get alerted when CVE-2024-29832 or the next vulnerability affects your stack