title: Envira Gallery Lite < 1.8.4.7 - Reflected Cross-Site Scripting
description: The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
problem types: CWE-79 Cross-Site Scripting (XSS)
affected:
{
vendor: Unknown
product: Gallery Plugin for WordPress – Envira Photo Gallery
versions:
version: 1.8.4.7, status: affected, lessThan: 1.8.4.7, versionType: custom
}