Wordpress Cool Video Gallery plugin command injection vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language.Cool Video Gallery is one of the video gallery plugin. A command injection vulnerability exists in Wordpress Cool Video Gallery plugin version 1.9 and earlier. An attacker can use this...

Wordpress Contest Gallery plugin XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress plugin contest-gallery XSS Vulnerability Software Link: https://wordpress.org/plugins/contest-gallery/ Version:2.03 Google dork: inurl:/wp-content/plugins/contest-gallery The code in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 Media Title or 2 Media Subtitle fields...

CVE-2015-7386

Multiple cross-site scripting XSS vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 Media Title or 2 Media Subtitle fields...

CVE-2015-5599

Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 albumid or 2 name parameter...

Unrestricted file upload

Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploadfolder/big/...

CVE-2015-5599

CVE-2015-5599 affects the WordPress plugin Powerplay Gallery (plugin version 3.3 and earlier) with multiple SQL injection vulnerabilities in upload.php. Attackers could remotely execute arbitrary SQL commands via the albumid or name parameters, as described by multiple sources (NVD entry and asso...

CVE-2015-5681

CVE-2015-5681 affects the WordPress Powerplay Gallery plugin, version 3.3. It describes an unrestricted file upload vulnerability in upload.php that allows a remote attacker to upload a file with an executable extension and then access it via a direct request to the file in *_uploadfolder/big/, p...

CVE-2015-5681

Unrestricted file upload vulnerability in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploadfolder/big/...

WordPress Gallery Plugin 1.0 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin is vulnerable to a Stored Cross-Site Scripting XSS vulnerability in the Image Label Name input...

WordPress ReFlex Gallery Plugin <= 3.1.3 - Unrestricted File Upload

This vulnerability is in admin/scripts/FileUploader/php.php. It allows an attacker to execute arbitrary PHP code by uploading a file with a PHP extension. And then an attacker can access it via a direct request to the file in uploads/ directory. Solution Update the plugin...

WordPress BP Gallery Plugin <= 1.2.5 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Upgrade the plugin...

WordPress NextGEN Gallery Plugin <= 1.9.5 - Stored XSS

This plugin is prone to a cross site scripting vulnerability via gallerypath parameter. Solution Update the plugin...

WordPress Gallery Plugin <= 3.8.3 - Arbitrary File Access

This plugin is prone to an arbitrary file access in gallery-plugin.php filename1 parameter. It allows attackers to read arbitrary files. Solution Upgrade plugin...

WordPress WP Easy Gallery Plugin <= 2.7 - SQL Injection

This plugin is prone to SQL injection via admin/overview.php galleryId parameter and admin/add-images.php multiple parameter. Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...

WordPress Photo Gallery Plugin Arbitrary File Upload Vulnerability

WordPress Photo Gallery Plugin is a wordpress image plugin. The WordPress Photo Gallery Plugin suffers from an arbitrary file upload vulnerability, which allows attackers to exploit the vulnerability to submit a special file and execute it with WEB privileges, as the program fails to properly...

Sql injection

SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the ascordesc parameter in a create gallery request in the galleriesbwg page to wp-admin/admin.php...

CVE-2015-1393

The CVE-2015-1393 entry concerns the Photo Gallery WordPress plugin (before 1.2.11). The vulnerability is a SQL injection in the asc_or_desc parameter of a create gallery request processed via galleries_bwg on wp-admin/admin.php, exploitable by remote authenticated users. The affected component i...

WordPress Plugin Photo Gallery Has Multiple Cross-Site Scripting Vulnerabilities

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress plugin Photo Gallery has multiple cross-site scripting vulnerabilities due to the program failing to properly filte...

Photo Gallery <= 1.2.8 - Multiple Authenticated Reflected XSS

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by a Multiple Authenticated Reflected XSS security vulnerability. PoC /wp-admin/admin-ajax.php?action=addImages=700=550=jpg,jpeg,png,gif=bwgaddpreviewimageby=name";...