CVE-2021-46889

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-468909.8Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affe CVE-2021-468919.8Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affe CVE-2021-468927.5Encryption bypass vulnerability in Maintenance mode. Successful exploitation of this vulnerability may affect service confidentiality.CVE-2021-468937.5Vulnerability of unstrict data verification and parameter check. Successful exploitation of this vulnerability may affect integrity.CVE-2021-468949.8Use After Free (UAF) vulnerability in the uinput module.Successful exploitation of this vulnerability may lead to kernel privilege escalatio CVE-2021-468959.1Vulnerability of defects introduced in the design process in the Multi-Device Task Center. Successful exploitation of this vulnerability wil CVE-2021-468967.5Buffer Overflow vulnerability in PX4-Autopilot allows attackers to cause a denial of service via handler function handling msgid 332.CVE-2021-468976.5views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traver CVE-2021-468986.1views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but t CVE-2021-468997.8SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application.CVE-2021-469007.5Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an CVE-2021-469017.5examples/6lbr/apps/6lbr-webserver/httpd.c in CETIC-6LBR (aka 6lbr) 1.5.0 has a strcat stack-based buffer overflow via a request for a long U