What is CVE-2022-0750?

CVE-2022-0750 is a medium-severity vulnerability in Deanoakley Photoswipe Masonry Gallery, classified under Cross-site Scripting. CVSS score: 6.4/10. Published 2022-03-23.

How severe is CVE-2022-0750?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Is CVE-2022-0750 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Deanoakley Photoswipe Masonry Gallery

CVE-2022-0750

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.044 (90.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.

Affected products

Deanoakley Photoswipe Masonry Gallery — versions 0
Thriveweb Photoswipe_masonry_gallery

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

security@wordfence.com (Third Party Advisory)
security@wordfence.com (Product)
security@wordfence.com (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2022-0750?: CVE-2022-0750 is a medium-severity vulnerability in Deanoakley Photoswipe Masonry Gallery, classified under Cross-site Scripting. CVSS score: 6.4/10. Published 2022-03-23.
How severe is CVE-2022-0750?: Medium severity. CVSS v3 base score is 6.4 out of 10.
Is CVE-2022-0750 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.