10Web Photo Gallery < 1.5.55 - SQL Injection

WordPress plugin 10Web Photo Gallery versions before 1.5.55 contains a SQL injection caused by unvalidated input in the 'bwgsearchx' parameter in frontend/models/model.php, letting attackers execute arbitrary SQL commands, exploit requires attacker to control the 'bwgsearchx' parameter. id:...

Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion

Joomla! Omilen Photo Gallery comomphotogallery component Beta 0.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php. id: CVE-2009-4202 info: name: Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion...

WordPress Photo Gallery by 10Web <1.5.69 - Cross-Site Scripting

WordPress Photo Gallery by 10Web plugin before 1.5.69 contains multiple reflected cross-site scripting vulnerabilities via the galleryid, tag, albumid and themeid GET parameters passed to the bwgfrontenddata AJAX action, available to both unauthenticated and authenticated users. id: CVE-2021-2429...

Photo Gallery WordPress v1.6.3 - SQL Injection

Photo Gallery WordPress plugin v1.6.3 contains a SQL injection caused by improper escaping of $POST'filtertag' parameter in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires sending crafted POST requests. id: CVE-2022-1281 info: name: Photo Gallery WordPress v1.6.3 -...

CVE-2022-0169

CVE-2022-0169 — WordPress Photo Gallery SQLi PoC This is a simple Python proof-of-concept PoC for CVE-2022-0169 , an SQL injection vulnerability in the WordPress Photo Gallery plugin. What it does Checks the WordPress version if available Exploits the vulnerable admin-ajax.php endpoint Dumps...

EUVD-2026-102796

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP...

CVE-2026-18557

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18557

The Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.42 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw exists in the 'title' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web script...

EUVD-2026-101844

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18557 Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for...

Photo Gallery by 10Web < 1.6.0 - SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection id:...

WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin <= 1.8.42 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Photo Gallery by 10Web versions = 1.8.42...

CVE-2026-107178

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...

CVE-2026-104644

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that execute...

EUVD-2026-100889

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...

CVE-2026-107178 Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that executes ...

WordPress Image Photo Gallery Final Tiles Grid plugin < 3.6.16 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Ala Bouali in WordPress Plugin Image Photo Gallery Final Tiles Grid versions 3.6.16...

CVE-2026-107178

The Image Photo Gallery Final Tiles Grid WordPress plugin versions prior to 3.6.16 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to escape gallery lightbox configuration values (specifically via the 'lightboxOptions' parameter) before they are printed in...

EUVD-2026-100876

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that execute...

CVE-2026-104644

The Image Photo Gallery Final Tiles Grid WordPress plugin, in versions prior to 3.6.15 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize or escape gallery configuration values before they are echoed into an inline script on pages embedding t...