Stored XSS in SimpLy Gallery Block & Lightbox WordPress Plugin

Executive Summary

The SimpLy Gallery Block & Lightbox plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.3.3.2. This vulnerability arises because the plugin does not properly sanitize and escape input on the sliderMaxHeight block attribute within the pgc_sgb_render_callback() function.

Specifically, the pgc_sgb_sanitize_custom_css() function uses a flawed regular expression that only removes event handlers with quoted values (like onfocus="alert()"), but fails to remove unquoted event handlers (like onfocus=alert(document.cookie)). This flaw allows attackers to inject malicious scripts that bypass sanitization.

Authenticated users with Author-level access or higher can exploit this vulnerability by injecting arbitrary web scripts into pages via block attributes. These scripts will execute whenever any user accesses the injected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers with Author-level access or above to inject malicious scripts into web pages. These scripts execute in the context of users visiting the affected pages, potentially leading to theft of sensitive information such as cookies, session tokens, or other data accessible via the browser.

The impact includes compromise of user accounts, unauthorized actions performed on behalf of users, and potential spread of malware or phishing attacks through the affected website.

Useful 0 Not Useful 0