Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site scripting (XSS) attacks via the (2) ll__opt[image2_url] or (3) ll__opt[image3_url] parameter in a ll_save_settings action to wp-admin/admin-ajax.php.

Remediation

References

CVE-2014-9441

Related Vulnerabilities

WordPress Plugin WooCommerce Export Orders and More Cross-Site Scripting (2.0.10)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-1813)

WordPress 4.7.x Multiple Vulnerabilities (4.7 - 4.7.1)

Drupal Inclusion of Functionality from Untrusted Control Sphere Vulnerability (CVE-2017-6381)

WordPress Plugin WordPress Download Manager Cross-Site Scripting (3.2.15)

Severity

Medium

Classification

CVE-2014-9441 CWE-352

Tags

Missing Update Known Vulnerabilities