CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Attackers can store JavaScript code like image tags with onerror handlers that execute when the gallery is previewed, affecting all users viewing the page.
Explanation of Vulnerability in Simple Terms
Filterable Portfolio Gallery contains a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction to trigger. An attacker with low-level access can craft a malicious request that, when visited by a site administrator or other user, executes arbitrary JavaScript in their browser session.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they visit affected pages.
Potential impact on your site
Attackers with user accounts can steal admin session tokens, modify site content, or redirect visitors to malicious sites.
Conditions required to exploit
Attacker must have low-level user account access; victim must click a malicious link or visit a crafted page.
Key dates
External resources
Related vulnerabilities
