CVE-2015-1394

Vulnerability

The Photo Gallery plugin for WordPress versions before 1.2.11 contains multiple cross-site scripting (XSS) vulnerabilities in the addImages action of wp-admin/admin-ajax.php. The sort_by, sort_order, items_view, dir, clipboard_task, clipboard_files, clipboard_src, and clipboard_dest parameters are not properly sanitized before output, allowing injection of arbitrary web script or HTML. The vulnerability is present in all versions prior to 1.2.11 [1].

Exploitation

An attacker must be an authenticated WordPress user with access to the admin area. The attacker can craft a malicious request to wp-admin/admin-ajax.php with the action=addImages parameter and inject script code into any of the listed parameters. No additional privileges or user interaction beyond authentication is required.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement, or theft of sensitive information such as cookies or admin credentials. The attack is limited to the scope of the authenticated user's permissions.

Mitigation

The vulnerability is fixed in version 1.2.11 of the Photo Gallery plugin. Users should update to the latest version (1.8.41 as of the reference) to ensure protection [1]. No workarounds are documented; updating is the recommended mitigation.