Youtube Channel Gallery Vulnerabilities

[en] The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 2.4

Fix:

No patched version reported

Disclosed:

Feb 13, 2023

CVE-2022-4783 on NVD →

The Youtube Channel Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 2.4 due to insufficient input sanitization and output escaping on user supplied attributes such as search_input_text. This makes it possible for authenticated attack...

CVSS:

6.4

Affected:

up to 2.4

Fix:

No patched version reported

Disclosed:

Jan 4, 2023

CVE-2022-4783 on NVD →

The Youtube Channel Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, and including, 2.4 due to insufficient input sanitization and output escaping on user supplied attributes such as search_input_text. This makes it possible for authenticated attack...

Affected:

up to 2.4

Fix:

No patched version reported

Disclosed:

Jan 4, 2023

No patched version available. An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Youtube Channel Gallery Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be ex...

Affected:

up to 2.4

Fix:

No patched version reported

Disclosed:

Jan 4, 2023