CVE-2024-29809: The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the…

PriorityP427medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.41%

32.9th percentile

The image_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the image_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
10web	photo_gallery	< 1.8.22	1.8.22
10web	photogallery	1.0.1 – 1.8.21	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.