4.8
Moyenne
CVE-2022-4142 The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the…
Description
The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WordPress Filter Gallery Plugin 0.1 | premières → < 0.1.6 | 0.1.6 |