A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.
Description:

Piwigo system album name and description of the location can be written to XSS code, resulting in persistent cross-site scripting attacks
Vulnerable Instances:
![image](https://user-images.githubusercontent.com/31758618/132280481-c0010337-32be-4359-9b10-8e31c89b0b74.png)

![image](https://user-images.githubusercontent.com/31758618/132280541-939cc6b4-f0de-4f1d-90df-9c89d10c344d.png)


Persistent cross-site scripts in Piwigo system album properties (version: 11.5.0)
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : Persistent cross-site scripts in Piwigo system album properties (version: 11.5.0)
Issue date:

--- start body ---
Description:

Piwigo system album name and description of the location can be written to XSS code, resulting in persistent cross-site scripting attacks
Vulnerable Instances:
![image](https://user-images.githubusercontent.com/31758618/132280481-c0010337-32be-4359-9b10-8e31c89b0b74.png)

![image](https://user-images.githubusercontent.com/31758618/132280541-939cc6b4-f0de-4f1d-90df-9c89d10c344d.png)


--- end body ---

Piwigo version 11.5.0 is vulnerable to persistent cross-site scripting (XSS) attacks due to improper handling of user input in the system album properties. Attackers can inject malicious scripts into the album name and description fields, which are then stored and executed in the context of other users' browsers when they view the album. This can lead to unauthorized actions being performed on behalf of users or the theft of sensitive information.