Maxgalleria
Monthly
Unauthenticated cross-site scripting (XSS) in MaxGalleria versions up to and including 6.5.3 allows remote attackers to inject malicious scripts into web pages viewed by victims, potentially leading to session hijacking, credential theft, or defacement. The plugin must be installed and active on a WordPress site, and exploitation requires a victim to interact with a crafted link (UI:R), making it a high-risk (CVSS 7.1) but interaction-dependent issue. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated cross-site scripting (XSS) in MaxGalleria versions up to and including 6.5.3 allows remote attackers to inject malicious scripts into web pages viewed by victims, potentially leading to session hijacking, credential theft, or defacement. The plugin must be installed and active on a WordPress site, and exploitation requires a victim to interact with a crafted link (UI:R), making it a high-risk (CVSS 7.1) but interaction-dependent issue. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability discovered in MaxGalleria WordPress plugin (versions 6.2.5). Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.