Post

CVE-2023-29439 Analysis

Posted
By LOURCODE 1 min read

Vulenerability details

Description

In Foogallery 2.2.35 and earlier, the function foogallery_image_editor_modal in foogallery/includes/admin/class-gallery-attachment-modal.php is vulnerable to XSS attack.

Pre-requisite

  • Unauthenticated

Proof-of-Concept

  1. Foogallery Settings → Admin → Enable Advanced Attachment Modal
  2. Send http://localhost:8080/wp-admin/post-new.php?post_type=foogallery&post=”><script>alert(1)</script>

References

CVE-2023-29439

bugbounty, WordPress
webhacking
This post is licensed under CC BY 4.0 by the author.