R3Foxx

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp review text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.

**Name of the Vulnerable Software and Affected Versions** The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.47 **Description** Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the `thumb url` parameter when the `editimage bwg` AJAX action is triggered. While a capability check is performed, the lack of nonce verification allows a payload to be delivered through a crafted GET request. Successful exploitation requires the victim to have the `manage options` capability and be tricked into clicking a malicious link to execute arbitrary web scripts. **Recommendations** Update the plugin to version 1.8.47 or later. As a temporary mitigation, restrict access to the `editimage bwg` AJAX action or avoid using the `thumb url` parameter until the update is applied.