Polo Video Gallery – Best wordpress video gallery plugin <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
mediumThe Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode
- CVSS:
- 5.4
- Affected:
- up to 1.2
- Fix:
- No patched version reported
- Disclosed:
- Sep 20, 2021