CVE-2021-24310: 
WordPress vulnerability analysis and mitigation

The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before version 1.5.67 contained a stored Cross-Site Scripting (XSS) vulnerability. The issue was discovered and disclosed on May 12, 2021, and was assigned CVE-2021-24310. This vulnerability was due to improper sanitization of gallery titles and represented an incomplete fix of a previous vulnerability (CVE-2019-16117) (Wordfence, WPScan).

The vulnerability allowed high-privilege users to create galleries with XSS payloads in their titles. The payload would be triggered when other users viewed either the gallery list or the affected gallery in the admin dashboard. A proof of concept exploit involved using a specially crafted payload as the gallery title: '" style="animation-name:rotation" onanimationstart="alert(/XSS/)'. The vulnerability received a CVSS score of 6.6 (medium severity) and was classified under CWE-79 (WPScan).

When exploited, this vulnerability could allow authenticated attackers to inject malicious JavaScript code that would execute in the browsers of other users when they viewed the affected gallery or gallery list in the WordPress admin dashboard (WPScan).

The vulnerability required an attacker to have high-privilege access to the WordPress installation to create or edit galleries. The exploit could be triggered when other users, including administrators, viewed the compromised gallery content in the admin dashboard (WPScan).

The vulnerability was patched in version 1.5.67 of the Photo Gallery plugin. Users should update to this version or later to protect against this security issue (WPScan).