CVE-2024-9778

CVE-2024-9778 (ImagePress – Image Gallery for WordPress) : CSRF vulnerability in ImagePress versions

CVE-2024-9018

The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2024-9018 WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter

The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘key’ parameter in all versions up to, and including, 4.8.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2024-8437 WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation

The WP Easy Gallery – WordPress Gallery Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX like wpegsettings and wpegaddgallery in all versions up to, and including, 4.8.5. This makes it possible for authenticate...

WordPress WP Easy Gallery plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation vulnerability

Missing Authorization to Authenticated Subscriber+ Gallery Manipulation vulnerability discovered by Lucio Sá in WordPress Plugin WP Easy Gallery versions = 4.8.5...

CVE-2024-3899

The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks...

CVE-2024-3899

CVE-2024-3899 affects the Gallery Plugin for WordPress (Envira Gallery) prior to 1.8.15. The issue is a stored cross-site scripting (XSS) vulnerability due to insufficient sanitization/escaping of image settings, exploitable by users with post-writing privileges (e.g., Authors). Red Hat and CVE d...

PT-2024-28305 · WordPress · Gallery Plugin

Name of the Vulnerable Software and Affected Versions: The Gallery Plugin for WordPress versions prior to 1.8.15 Description: The issue is related to the lack of sanitization and escaping of some image settings in the plugin, which could allow users with post-writing privileges, such as Authors, ...

WordPress Responsive Lightbox & Gallery plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload vulnerability

Authenticated Author+ Stored Cross-Site Scripting via File Upload vulnerability discovered by wesley wcraft in WordPress Plugin Responsive Lightbox versions = 2.4.7...

PT-2024-37917 · WordPress · Responsive Lightbox & Gallery

Name of the Vulnerable Software and Affected Versions: The Responsive Lightbox & Gallery plugin for WordPress versions up to, and including, 2.4.7 Description: The issue is related to Stored Cross-Site Scripting via file uploads due to insufficient input sanitization and output escaping, affectin...

WordPress Contest Gallery Plugin <= 23.1.2 is vulnerable to Sensitive Data Exposure

Software Contest Gallery Type Plugin Vulnerable versions = 23.1.2 Fixed in 23.1.3 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2024-43283 Patch priority Low CVSS severity Low 5.3 Developer Wasiliy Strecker PSID 7195b9ccc688 Credits Joshu...

WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.15.6 is vulnerable to Cross Site Scripting (XSS)

Software 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Type Plugin Vulnerable versions = 1.15.6 Fixed in 1.15.7 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43152 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID c27b38c9e4e0...

WordPress plugin Contest Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

WordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin Contest Gallery versions = 23.1.2...

CVE-2024-6629

The All-in-One Video Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video shortcode in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-6629

CVE-2024-6629 affects All-in-One Video Gallery for WordPress; versions up to and including 3.7.1 are vulnerable to Stored Cross-Site Scripting via the Video shortcode due to insufficient input sanitization and output escaping. Exploitation requires at least contributor-level authentication. The v...

WordPress Contest Gallery Plugin <= 23.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Contest Gallery Type Plugin Vulnerable versions = 23.1.2 Fixed in 23.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-39631 Patch priority Medium CVSS severity Medium 7.1 Developer Wasiliy Strecker PSID e98eae916e49 Credits CatFather Required privilege...

CVE-2024-5442

The Photo Gallery, Sliders, Proofing and WordPress plugin before 3.59.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2024-37542 WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3...

CVE-2024-6262 Portfolio Gallery – Image Gallery Plugin <= 1.6.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

The Portfolio Gallery – Image Gallery Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PFG' shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...