Skip to content
Sign in
4.8 Medium

CVE-2022-4142 The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the…

Description

The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled.

Affected products and versions

Product Affected versions Fixed in
WordPress Filter Gallery Plugin 0.1 earliest → < 0.1.6 0.1.6
Track this CVE