Description
The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XSS) attack by wrapping a payload in "<<script></script>script>payload<script></script></script>", or in an image tag, with the payload as the onerror event.
Remediation
References
Related Vulnerabilities
WordPress Plugin Abandoned Cart Lite for WooCommerce Cross-Site Request Forgery (5.8.5)
MediaWiki Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2021-42040)
PHP Out-of-bounds Write Vulnerability (CVE-2016-7126)
WordPress Plugin Startklar Elementor Addons Arbitrary File Deletion (1.7.13)