File Gallery < 1.8.5.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress File Gallery Plugin <= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS)

Software File Gallery Type Plugin Vulnerable versions = 1.8.5.3 Fixed in 1.8.5.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23676 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d0eae18428aa Credits István Márton Required...

File Gallery 1.7.9 - Settings Page create_function Function Remote Comm& Execution

The File Gallery WordPress plugin was affected by a Settings Page createfunction Function Remote Comm& Execution security vulnerability...

CVE-2014-2558

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

Design/Logic Flaw

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

CVE-2014-2558

The CVE-2014-2558 entry concerns the WordPress File Gallery plugin (versions before 1.7.9.2). The vulnerability stems from improper escaping in the Settings Page that allows a remote attacker to trigger arbitrary PHP code execution via a backslash-quote in fields referencing /wp-admin/options-med...

CVE-2014-2558

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

WordPress File Gallery Plugin <= 1.7.9.1 - Arbitrary Code Execution

This plugin does not properly escape strings, which allows remote administrators to execute arbitrary PHP code. Solution Update the plugin...

CVE-2007-1125

Cross-site scripting XSS vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2007-1125

CVE-2007-1125 describes a cross-site scripting (XSS) vulnerability in gallery.php of XeroXer Simple one-file gallery, exploitable via the f parameter to inject arbitrary script/HTML. Connected sources confirm the issue and its basic impact (client-side script injection) but do not provide explici...

Simple one-file Gallery - gallery.php?f Traversal Arbitrary File Access

Simple one-file Gallery - gallery.php?f Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/22700/info Simple one-file gallery is prone to multiple input-validation vulnerabilities, including a local file-include issue and a cross-site scripting issue. An attacker can exploi...