CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery Custom Links gallery-custom-links allows Stored XSS.This issue affects Gallery Custom Links: from n/a through <= 2.2.5.
Explanation of Vulnerability in Simple Terms
Gallery Custom Links versions 2.2.5 and earlier contain a cross-site scripting vulnerability. An authenticated user with high privileges can inject malicious scripts into gallery links. When another user views the affected page, the script executes in their browser, potentially compromising their session or stealing data. The vulnerability requires user interaction and affects the scope beyond the vulnerable component.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they view gallery links.
Potential impact on your site
Authenticated admins can inject scripts affecting other users' sessions and data; requires immediate patching.
Conditions required to exploit
Attacker must have high-level admin privileges and the victim must visit a page containing the malicious link.
Key dates
External resources
