Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
LightGallery WP
Vendor
lightgalleryteam
Product
LightGallery WP
Platforms
Unknown
Default status
unaffected
LightGallery WP · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.0.5
None listed
TP WooCommerce Product Gallery
Vendor
tplugins
Product
TP WooCommerce Product Gallery
Platforms
Unknown
Default status
unaffected
TP WooCommerce Product Gallery · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.1.9
None listed
Ibtana – WordPress Website Builder
Vendor
vowelweb
Product
Ibtana – WordPress Website Builder
Platforms
Unknown
Default status
unaffected
Ibtana – WordPress Website Builder · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.2.5.1
None listed
Royal Addons for Elementor – Addons and Templates Kit for Elementor
Vendor
wproyal
Product
Royal Addons for Elementor – Addons and Templates Kit for Elementor
Platforms
Unknown
Default status
unaffected
Royal Addons for Elementor – Addons and Templates Kit for Elementor · Scoped product and version facts