CVE-2022-38135

Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin = 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings...

Improper access control

Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin = 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings...

CVE-2022-38135 WordPress Photospace Gallery plugin <= 2.3.5 - Broken Access Control vulnerability

Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin = 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings...

CVE-2022-2633

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

CVE-2022-2633

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

Server side request forgery (ssrf)

The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found in the /public/video.php file in versions up to, and including 2.6.0. This makes it possible for unauthenticated users to download sensiti...

The vulnerability of the Video Gallery plugin of the WordPress content management system allows attackers to bypass existing security restrictions.

The vulnerability of the Video Gallery plugin in the WordPress content management system is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

CVE-2022-36394

Authenticated author+ SQL Injection SQLi vulnerability in Contest Gallery plugin = 17.0.4 at WordPress...

Sql injection

Authenticated author+ SQL Injection SQLi vulnerability in Contest Gallery plugin = 17.0.4 at WordPress...

CVE-2022-35726 WordPress Video Gallery plugin <= 1.3.4.5 - Broken Authentication vulnerability

Broken Authentication vulnerability in yotuwp Video Gallery plugin = 1.3.4.5 at WordPress...

CVE-2022-35726

The CVE-2022-35726 entry concerns the yotuwp Video Gallery WordPress plugin, affected versions 1.3.4.5 and earlier, with a Broken Authentication vulnerability. Technical details across connected sources confirm the vulnerability lies in the plugin’s authentication mechanism, enabling unauthorized...

CVE-2022-36394 WordPress Contest Gallery plugin <= 17.0.4 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated author+ SQL Injection SQLi vulnerability in Contest Gallery plugin = 17.0.4 at WordPress...

WordPress plugin Video Gallery 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An authorization issue vulnerability exists...

PT-2022-23351 · WordPress · Contest Gallery

Name of the Vulnerable Software and Affected Versions: Contest Gallery plugin versions = 17.0.4 Description: The issue is an authenticated SQL Injection vulnerability, affecting the Contest Gallery plugin at WordPress. This allows for SQL injection attacks when an attacker has author or higher...

WordPress plugin nextgen-galery 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-1946

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

CVE-2022-1946 Gallery < 2.0.0 - Reflected Cross-Site Scripting

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action available to both unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting issue...

WordPress plugin Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2022-1971

The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-1327

The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...