Executive brief
The Filterable Portfolio Gallery plugin for WordPress, which is used to display image galleries and portfolios, contains a security flaw. An authorized user can insert malicious scripts into the gallery title field. When other users or administrators view the gallery, these scripts execute automatically, potentially allowing the attacker to hijack sessions or perform unauthorized actions on the website.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Filterable Portfolio Gallery plugin version 1.0 for WordPress. The vulnerability is located in the 'title' field of the gallery creation interface, which fails to properly sanitize user-supplied input. An authenticated attacker with sufficient privileges to create or edit galleries can inject malicious JavaScript payloads (such as image tags with onerror handlers). Because the payload is stored in the database, the script executes in the browser of any user who previews or views the affected gallery. This can lead to session hijacking or unauthorized administrative actions. No patch is currently documented, and the plugin appears to be unmaintained.
Affected products
- Akram ul haq Filterable Portfolio Gallery 1.0
Timeline
- 2021-10-25: disclosed: Initial discovery and exploit publication by Murat Demirci
- 2026-05-10: advisory: NVD/VulnCheck advisory published