CVEvulnerability
CVE-2014-6315
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-10-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) callback, (2) dir, or (3) extensions parameter in an addImages action to wp-admin/admin-ajax.php.
Affected configurations
• photo gallery plugin project photo gallery plugin 1.1.30
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://packetstormsecurity.com/files/128518/WordPress-Photo-Gallery-1.1.30-Cross-Site-Scripting.html Exploit
- http://secunia.com/advisories/61649 secunia.com
- http://www.securityfocus.com/archive/1/533595/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/70204 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96799 exchange.xforce.ibmcloud.com
- https://plugins.trac.wordpress.org/changeset?new=986500 Exploit
- https://www.htbridge.com/advisory/HTB23232 Exploit
- http://packetstormsecurity.com/files/128518/WordPress-Photo-Gallery-1.1.30-Cross-Site-Scripting.html Exploit
- http://secunia.com/advisories/61649 secunia.com
- http://www.securityfocus.com/archive/1/533595/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/70204 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96799 exchange.xforce.ibmcloud.com
- https://plugins.trac.wordpress.org/changeset?new=986500 Exploit
- https://www.htbridge.com/advisory/HTB23232 Exploit