Description
The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it.
Remediation
References
Related Vulnerabilities
WordPress Plugin MiwoEvents-Manage & Book Events Unspecified Vulnerability (1.2.0)
WordPress 4.5.x Multiple Vulnerabilities (4.5 - 4.5.2)
Moodle Improper Input Validation Vulnerability (CVE-2012-0795)
WordPress Plugin Total Donations for Wordpress Security Bypass (2.0.5)
WordPress Plugin PayPal Digital Downloads Cross-Site Request Forgery (1.4)