Description
The sanitize_string function in Zenphoto before 1.4.9 does not properly sanitize HTML tags, which allows remote attackers to perform a cross-site scripting (XSS) attack by wrapping a payload in "<<script></script>script>payload<script></script></script>", or in an image tag, with the payload as the onerror event.
Remediation
References
Related Vulnerabilities
WordPress Plugin Discount Rules for WooCommerce Multiple Vulnerabilities (2.0.2)
Moodle CVE-2024-34009 Vulnerability (CVE-2024-34009)
MySQL CVE-2014-4258 Vulnerability (CVE-2014-4258)
WordPress Plugin MyBB Cross-Poster Cross-Site Scripting (1.0)
WordPress Plugin Intuitive Custom Post Order Multiple Vulnerabilities (3.1.3)