CVE-2022-36292: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerabilities in WPChill Gallery PhotoBlocks plugin = 1.2.6 at WordPress...

Gallery PhotoBlocks <= 1.2.6 - Cross-Site Request Forgery

The plugin does not have CSRF check in some places, which could allow attackers to make logged in users perform unwanted actions...

Gallery PhotoBlocks <= 1.2.6 - Authenticated Stored XSS

The plugin does not sanitise and escape some parameters, which could allow low privileged users to perform Stored Cross-Site Scripting attacks...

WordPress Gallery PhotoBlocks plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerabilities

Cross-Site Request Forgery CSRF vulnerabilities leading to Gallery Delete / Copy discovered by Ngo Van Thien Patchstack Alliance in WordPress Gallery PhotoBlocks plugin versions = 1.2.7. Solution Deactivate and delete. This plugin has been closed as of August 10, 2022 and is not available for...

Gallery PhotoBlocks < 1.2.0 - Authenticated Cross-Site Scripting (XSS)

The vulnerability is due to insufficient validation of gallery name parameter and image caption parameter. A remote attacker any authenticated low privileged user can exploit this to execute arbitrary script code within the context of the application...

WordPress Gallery Photoblocks plugin <= 1.1.42 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found in WordPress Gallery Photoblocks plugin versions = 1.1.42. Solution Update the WordPress Gallery Photoblocks plugin to the latest available version at least 1.1.43...

Gallery Photoblocks < 1.1.43 - Authenticated Reflected XSS

The Gallery PhotoBlocks WordPress plugin was affected by an Authenticated Reflected XSS security vulnerability. PoC When logged in with an account with administrator capabilities: https:///wp-admin/admin.php?page=photoblocks-edit="...

Gallery Photoblocks < 1.1.43 - Authenticated Reflected XSS

The Gallery PhotoBlocks WordPress plugin was affected by an Authenticated Reflected XSS security vulnerability. When logged in with an account with administrator capabilities: https:///wp-admin/admin.php?page=photoblocks-edit&id="...

WordPress Gallery Photoblocks plugin <= 1.1.40 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability

Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found in WordPress Gallery Photoblocks plugin versions = 1.1.40. Solution Update the WordPress Gallery Photoblocks plugin to the latest available version at least 1.1.41...

Gallery Photoblocks < 1.1.41 - Unauthenticated Reflected XSS

Also Full Path Disclosure depending on the configuration of the server https:///wp-content/plugins/photoblocks-grid-gallery/admin/partials/photoblocks-edit.php?id="...