Gallery Custom Links
Monthly
Stored cross-site scripting in the Gallery Custom Links WordPress plugin (all versions up to and including 2.3.3) lets an authenticated attacker with subscriber-level access or higher inject arbitrary script that executes in the browser of anyone viewing the affected page. Exploitation is not opportunistic: it requires two coordinated attacker-supplied inputs - an HTML-comment payload stored in a comment body (preserved by WordPress comment kses) plus a matching simple_html_dom 'noise key' in the attacker's profile display_name that survives esc_attr() - both of which must be present before the plugin's default-on output-buffering pass rewrites the rendered page (AC:H, PR:L, UI:N, scope-changed per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the low CVSS base score of 4.9 reflects genuine low priority despite the CWE-79 class.
Stored cross-site scripting in the Gallery Custom Links WordPress plugin (all versions up to and including 2.3.3) lets an authenticated attacker with subscriber-level access or higher inject arbitrary script that executes in the browser of anyone viewing the affected page. Exploitation is not opportunistic: it requires two coordinated attacker-supplied inputs - an HTML-comment payload stored in a comment body (preserved by WordPress comment kses) plus a matching simple_html_dom 'noise key' in the attacker's profile display_name that survives esc_attr() - both of which must be present before the plugin's default-on output-buffering pass rewrites the rendered page (AC:H, PR:L, UI:N, scope-changed per CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the low CVSS base score of 4.9 reflects genuine low priority despite the CWE-79 class.