Non notée
CVE-2021-24293 In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call…
Description
In the eCommerce module of the NextGEN Gallery Pro WordPress plugin before 3.1.11, there is an action to call get_cart_items via photocrati_ajax , after that the settings[shipping_address][name] is able to inject malicious javascript.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| NextGen Gallery Pro 3.1 | premières → < 3.1.11 | 3.1.11 |