Easy Image Gallery
Monthly
The Easy Image Gallery plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Gallery shortcode post meta field that affects all versions up to and including 1.5.3. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browsers of users viewing the affected pages, potentially compromising user sessions, stealing credentials, or performing actions on behalf of legitimate users. The vulnerability stems from insufficient input sanitization and output escaping in the shortcode handler, as documented in the WordPress plugin repository source code.
The Easy Image Gallery plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the Gallery shortcode post meta field that affects all versions up to and including 1.5.3. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browsers of users viewing the affected pages, potentially compromising user sessions, stealing credentials, or performing actions on behalf of legitimate users. The vulnerability stems from insufficient input sanitization and output escaping in the shortcode handler, as documented in the WordPress plugin repository source code.