Photo Gallery by 10Web – Mobile-Friendly Image Gallery, 6f3a85f6334d5ad6ee6706e16a7bcf7eb5c4e3b6
- CVE, Research URL
- Published on
- Nov 26, 2022
- Research Description
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery] < 1.8.8 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.7 - Open Redirect The Photo Gallery by 10Web plugin for WordPress is vulnerable to open redirect in versions up to 1.8.7. This is due to insufficient validation of the curr_url ($current_url) request parameter when a user accesses a link with an invalid share link. This would make it possible for an attacker to redirect a victim to a potentially malicious site, granted they could trick the victim into performing an action such as clicking on a link. The patches in 1.8.1, 1.8.3, 1.8.7 are incomplete and can be bypassed.
- Affected versions
-
max 1.8.8.
- Status
-
vulnerable