CVE-2025-0613

Description

The Photo Gallery by 10Web WordPress plugin before 1.8.34 does not sanitised and escaped comment added on images by unauthenticated users, leading to an Unauthenticated Stored-XSS attack when comments are displayed

Reserved 2025-01-21 | Published 2025-03-31 | Updated 2025-03-31 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Default status
unaffected

Any version before 1.8.34
affected

Credits

Matthew Rollings finder

WPScan coordinator

References

wpscan.com/...rability/22be2b44-cd42-4b02-8448-59dd2989dde1/ exploit vdb-entry technical-description

cve.org (CVE-2025-0613)

nvd.nist.gov (CVE-2025-0613)

Download JSON