Description
The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
Published: 2024-03-26
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-26804 The thumb_url parameter of the AJAX call to the editimage_bwg action of admin-ajax.php is vulnerable to reflected Cross Site Scripting. The value of the thumb_url parameter is embedded within an existing JavaScript within the response allowing arbitrary JavaScript to be inserted and executed. The attacker must target a an authenticated user with permissions to access this component to exploit this issue.
History

Wed, 09 Apr 2025 16:00:00 +0000

Type Values Removed Values Added
First Time appeared 10web
10web photo Gallery
CPEs cpe:2.3:a:10web:photo_gallery:*:*:*:*:*:wordpress:*:*
Vendors & Products 10web
10web photo Gallery

Subscriptions

10web Photo Gallery
cve-icon MITRE

Status: PUBLISHED

Assigner: AppCheck

Published:

Updated: 2024-08-02T16:44:14.472Z

Reserved: 2024-03-19T16:26:38.385Z

Link: CVE-2024-29810

cve-icon Vulnrichment

Updated: 2024-08-02T01:17:58.441Z

cve-icon NVD

Status : Analyzed

Published: 2024-03-26T16:15:12.707

Modified: 2026-06-17T07:23:09.790

Link: CVE-2024-29810

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')