PT-2023-19119 · WordPress · File Gallery

Name of the Vulnerable Software and Affected Versions: File Gallery plugin versions = 1.8.5.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This allows for malicious scripts to be stored on the serve...

WordPress plugin File Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

File Gallery < 1.8.5.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress File Gallery Plugin <= 1.8.5.3 is vulnerable to Cross Site Scripting (XSS)

Software File Gallery Type Plugin Vulnerable versions = 1.8.5.3 Fixed in 1.8.5.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23676 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID d0eae18428aa Credits István Márton Required...

File Gallery 1.7.9 - Settings Page create_function Function Remote Comm& Execution

The File Gallery WordPress plugin was affected by a Settings Page createfunction Function Remote Comm& Execution security vulnerability...

CVE-2014-2558

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

Design/Logic Flaw

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

CVE-2014-2558

The CVE-2014-2558 entry concerns the WordPress File Gallery plugin (versions before 1.7.9.2). The vulnerability stems from improper escaping in the Settings Page that allows a remote attacker to trigger arbitrary PHP code execution via a backslash-quote in fields referencing /wp-admin/options-med...

CVE-2014-2558

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

CVE-2014-2558: Improper Control of Generation of Code

The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a ' backslash quote in the setting fields to /wp-admin/options-media.php, related to the createfunction function...

WordPress File Gallery Plugin <= 1.7.9.1 - Arbitrary Code Execution

This plugin does not properly escape strings, which allows remote administrators to execute arbitrary PHP code. Solution Update the plugin...

CVE-2007-1125

Cross-site scripting XSS vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2007-1125

CVE-2007-1125 describes a cross-site scripting (XSS) vulnerability in gallery.php of XeroXer Simple one-file gallery, exploitable via the f parameter to inject arbitrary script/HTML. Connected sources confirm the issue and its basic impact (client-side script injection) but do not provide explici...

CVE-2007-1125: Undefined Security Weakness

Cross-site scripting XSS vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2007-1124: Undefined Security Weakness

Directory traversal vulnerability in gallery.php in XeroXer Simple one-file gallery allows remote attackers to read arbitrary files via a .. dot dot in the f parameter...

Simple one-file Gallery - gallery.php?f Traversal Arbitrary File Access

Simple one-file Gallery - gallery.php?f Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/22700/info Simple one-file gallery is prone to multiple input-validation vulnerabilities, including a local file-include issue and a cross-site scripting issue. An attacker can exploi...