CVE-2023-2402

The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-41658 appears to be a duplicate of this issue.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2808029%40wp-responsive-photo-gallery%2Ftags%2F1.0.13&new=2905480%40wp-responsive-photo-gallery%2Ftags%2F1.0.14Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/51a1c2de-56be-4487-874a-a916e8a6992a?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2808029%40wp-responsive-photo-gallery%2Ftags%2F1.0.13&new=2905480%40wp-responsive-photo-gallery%2Ftags%2F1.0.14Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/51a1c2de-56be-4487-874a-a916e8a6992a?source=cveThird Party Advisory

Published

Jun 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24012An attacker can arbitrarily craft malicious DDS Participants…8.2
• CVE-2023-24014Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and pr…7.8
• CVE-2023-24015A partial DoS vulnerability has been detected in the Reports…4.3
• CVE-2023-24016Uncontrolled search path element in some Intel(R) Quartus(R)…7.3
• CVE-2023-24018A stack-based buffer overflow vulnerability exists in the li…8.8
• CVE-2023-24019A stack-based buffer overflow vulnerability exists in the ur…8.1
• CVE-2023-24020 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior c…9.8
• CVE-2023-24021Incorrect handling of '\0' bytes in file uploads in ModSecur…7.5
• CVE-2023-24022Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB dev…9.8
• CVE-2023-24023Bluetooth BR/EDR devices with Secure Simple Pairing and Secu…6.8
• CVE-2023-24025CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Al…7.5
• CVE-2023-24026In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vu…6.1