Not rated
CVE-2021-24293 In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call…
Description
In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| NextGen Gallery Pro 3.1 | earliest → < 3.1.11 | 3.1.11 |