Zero-Day Advisory
Fortinet Discovers WordPress Gallery Bank Plugin Cross-Site Scripting Vulnerability
Summary
Fortinet's FortiGuard Labs has discovered a cross-site scripting (XSS) vulnerability in WordPress Gallery Bank Plugin.
Gallery Bank is a powerful photo gallery plugin with over 10,000+ installations. It is designed with advanced features to showcase image galleries in the most beautiful and authentic way.
A stored XSS vulnerability exists in Gallery Bank Plugin 4.0.50 and below. Any low privileged user with gallery bank access (Author+) can inject arbitrary javascript code in add gallery form.
Solutions
FortiGuard Labs released the following FortiGate IPS signature which covers this specific vulnerability:WordPress.Gallery.Bank.Plugin.GalleryDesc.Stored.XSS
Released Jun 06, 2022
Stop using this vulnerable plugin since it's not updated any more.Â
Timeline
Fortinet reported the vulnerability on Oct 29, 2021
The issue escalated to WordPress Plugins Team on Nov 9, 2021
The Plugin closed by WordPress Plugins Team on Dec 9, 2021