CVE:CVE-2013-3261
CNNVD:CNNVD-201305-603
WordPress是WordPress软件基金会的一套使用PHP语言开发的博客平台，该平台支持在PHP和MySQL的服务器上架设个人博客网站。GRAND FlAGallery（flash-album-gallery）是其中的一个集图片库、视频库和音乐专辑于一体的媒体插件。
WordPress的GRAND FlAGallery插件2.72之前版本中存在跨站脚本漏洞，该漏洞源于通过‘s’GET参数传送到wp-admin/admin.php (当‘page’设置为‘flag-manage-gallery’)的输入返回给用户之前没有正确过滤。攻击者可利用该漏洞在受影响站点上下文中用户浏览中执行任意HTML和脚本代码。
solution:Upgrade photogallerycreator flash-album-gallery to a higher version than 2.71,0.29,0.32,0.33,0.34,0.35,0.36,0.37,0.38,0.39,0.39:pl1,0.39:pl2,0.39:pl3,0.40,0.41,0.42,0.43,0.44,0.45,0.46,0.49,0.50,0.52,0.53,0.54,0.55,0.56,0.57,0.58,0.58:pl1,0.59,0.60,0.61,1.11,1.12,1.13,1.20,1.21,1.22,1.23,1.31,1.32,1.33,1.40,1.41,1.42,1.43,1.44,1.45,1.47,1.48,1.49,1.50,1.51,1.52,1.53,1.54,1.55,1.56,1.57,1.58,1.59,1.60,1.61,1.62,1.63,1.64,1.65,1.66,1.67,1.70,1.71,1.72,1.73,1.74,1.75,1.76,1.77,1.78,1.79,1.80,1.81,1.82,1.83,1.84,1.85,1.90,2.00,2.10,2.11,2.12,2.14,2.15,2.16,2.17,2.18,2.50,2.51,2.52,2.53,2.54,2.55,2.56,2.70,and avoid the version (,2.71],0.29,0.32,0.33,0.34,0.35,0.36,0.37,0.38,0.39,0.39:pl1,0.39:pl2,0.39:pl3,0.40,0.41,0.42,0.43,0.44,0.45,0.46,0.49,0.50,0.52,0.53,0.54,0.55,0.56,0.57,0.58,0.58:pl1,0.59,0.60,0.61,1.11,1.12,1.13,1.20,1.21,1.22,1.23,1.31,1.32,1.33,1.40,1.41,1.42,1.43,1.44,1.45,1.47,1.48,1.49,1.50,1.51,1.52,1.53,1.54,1.55,1.56,1.57,1.58,1.59,1.60,1.61,1.62,1.63,1.64,1.65,1.66,1.67,1.70,1.71,1.72,1.73,1.74,1.75,1.76,1.77,1.78,1.79,1.80,1.81,1.82,1.83,1.84,1.85,1.90,2.00,2.10,2.11,2.12,2.14,2.15,2.16,2.17,2.18,2.50,2.51,2.52,2.53,2.54,2.55,2.56,2.70