CVE-2021-24291

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)

• CWE-79

• https://packetstormsecurity.com/files/162227/Exploit, Third Party Advisory, VDB Entry
• https://wpscan.com/vulnerability/cfb982b2-8b6d-4345-b3ab-3d2b130b873aExploit, Third Party Advisory
• https://packetstormsecurity.com/files/162227/Exploit, Third Party Advisory, VDB Entry
• https://wpscan.com/vulnerability/cfb982b2-8b6d-4345-b3ab-3d2b130b873aExploit, Third Party Advisory

Published

May 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24286The settings page of the Redirect 404 to parent WordPress pl…6.1
• CVE-2021-24287The settings page of the Select All Categories and Taxonomie…6.1
• CVE-2021-24288When subscribing using AcyMailing, the 'redirect' parameter …6.1
• CVE-2021-24289There is functionality in the Store Locator Plus for WordPre…8.8
• CVE-2021-2429Vulnerability in the MySQL Server product of Oracle MySQL (c…5.9
• CVE-2021-24290There are several endpoints in the Store Locator Plus for Wo…6.1
• CVE-2021-24292The Happy Addons for Elementor WordPress plugin before 2.24.…5.4
• CVE-2021-24293In the eCommerce module of the NextGEN Gallery Pro WordPress…6.1
• CVE-2021-24294The dsgvoaio_write_log AJAX action of the DSGVO All in one f…6.1
• CVE-2021-24295It was possible to exploit an Unauthenticated Time-Based Bli…7.5
• CVE-2021-24296The WP Customer Reviews WordPress plugin before 3.5.6 did no…4.8
• CVE-2021-24297The Goto WordPress theme before 2.1 did not properly sanitiz…6.1