CVE-2021-46889 Cross-site scripting in n/a

What is CVE-2021-46889?

CVE-2021-46889 is a medium-severity cross-site scripting vulnerability in n/a, published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.

Weakness: CWE-79

Which versions are affected by CVE-2021-46889?

It affects 1 product.

Products include 10web Photo Gallery.

How do I fix CVE-2021-46889?

No fix has been published for CVE-2021-46889 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-46889 being exploited?

There is no known exploitation of CVE-2021-46889 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-1281 Photo Gallery < 1.6.3 - Unauthenticated SQL Injection Critical 9.8
• CVE-2022-0169 Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection Critical 9.8
• CVE-2021-24139 Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection Critical 9.8
• CVE-2019-16119 SQL injection in n/a Critical 9.8
• CVE-2019-14313 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6fq7-325c-xvfq.