CVE-2021-31693 Cross-site scripting in n/a

What is CVE-2021-31693?

CVE-2021-31693 is a medium-severity cross-site scripting vulnerability in n/a, published on 29 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware information, previously connected to this CVE ID because of a typo, is at CVE-2022-31693.

Weakness: CWE-79

Which versions are affected by CVE-2021-31693?

It affects 1 product.

Products include 10web Photo Gallery.

How do I fix CVE-2021-31693?

No fix has been published for CVE-2021-31693 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-31693 being exploited?

There is no known exploitation of CVE-2021-31693 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-1281 Photo Gallery < 1.6.3 - Unauthenticated SQL Injection Critical 9.8
• CVE-2022-0169 Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection Critical 9.8
• CVE-2021-24139 Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection Critical 9.8
• CVE-2019-16119 SQL injection in n/a Critical 9.8
• CVE-2019-14313 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8624-7rmq-755f.