CVE-2024-29833

WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler

The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target an authenticated user with permissions to access this feature, however once uploaded the payload is also accessible to unauthenticated users.

We have discovered 26,786 live websites that are affected by CVE-2024-29833.

Run a Free Instant Scan



Affected Software

Product  Photo Gallery by 10Web
Category Wordpress Plugins
Vulnerable Domains26,786 live websites (30% of Photo Gallery by 10Web install base)
Vulnerable Versions
  • from 1.0.1 through 1.8.21
Vulnerable Versions Count331 versions ( 54% of all versions)



Details

  • Published - Mar 26, 2024
  • Updated - Aug 2, 2024

Credits

  • AppCheck Ltd. (finder)

Website Distribution by Country

Number of websites using CVE-2024-29833
United States4,612 websites


Germany2,990 websites
Italy1,899 websites
Russia1,600 websites
Poland1,459 websites
France1,445 websites
GB1,093 websites
Czech Republic826 websites
Netherlands791 websites
Japan710 websites

Website Distribution by TLD

Number of websites using CVE-2024-29833
.com8,592 websites
.de1,734 websites
.ru1,285 websites
.it1,281 websites
.org1,270 websites
.pl1,107 websites
.cz714 websites
.nl672 websites
.co.uk592 websites
.net577 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-29833

Top websites that are affected by CVE-2024-29833. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.name France**,***
**********.**.uk GB**,***
********.cz Czech Republic**,***
************.net Russia**,***
***.org United States**,***
******************.org Belize**,***
*****.edu United States***,***
***************.com United States***,***
******.com United States***,***
***************.it Italy***,***
See full domain list

FAQ

A total of 26,786 websites have been identified as vulnerable to CVE-2024-29833, based on global website indexing conducted by WebTechSurvey.
The Photo Gallery by 10Web is affected by the CVE-2024-29833 vulnerability.
Photo Gallery by 10Web versions up to and including 1.8.21 are vulnerable to CVE-2024-29833.