CVE-2022-0750

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-07518.8Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with CVE-2022-07526.1Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.CVE-2022-07536.1Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.CVE-2022-07546.5SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5.CVE-2022-07554.3Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.CVE-2022-07566.5Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.CVE-2022-07578.8Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined CVE-2022-07586.1Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability, within the shared scan configuration CVE-2022-07598.1A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it pars CVE-2022-07609.8The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statemen CVE-2022-07624.3Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.CVE-2022-07634.8Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.