CVE-2021-25041

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web WordPress plugin versions prior to 1.5.68

Description: The issue is related to Reflected Cross-Site Scripting (XSS) via the bwg album breadcrumb 0 and shortcode id GET parameters passed to the bwg frontend data AJAX action.

Recommendations: For versions prior to 1.5.68, update to version 1.5.68 or later to resolve the issue. As a temporary workaround, consider restricting access to the bwg frontend data AJAX action to minimize the risk of exploitation. Avoid using the bwg album breadcrumb 0 and shortcode id parameters in the affected AJAX action until the issue is resolved.