WordPress Gallery Plugin 1.0 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin is vulnerable to a Stored Cross-Site Scripting XSS vulnerability in the Image Label Name input...

WordPress ReFlex Gallery Plugin <= 3.1.3 - Unrestricted File Upload

This vulnerability is in admin/scripts/FileUploader/php.php. It allows an attacker to execute arbitrary PHP code by uploading a file with a PHP extension. And then an attacker can access it via a direct request to the file in uploads/ directory. Solution Update the plugin...

WordPress BP Gallery Plugin <= 1.2.5 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Upgrade the plugin...

WordPress WP Easy Gallery Plugin <= 2.7 - SQL Injection

This plugin is prone to SQL injection via admin/overview.php galleryId parameter and admin/add-images.php multiple parameter. Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...

WordPress NextGEN Gallery Plugin <= 1.9.5 - Stored XSS

This plugin is prone to a cross site scripting vulnerability via gallerypath parameter. Solution Update the plugin...

WordPress Gallery Plugin <= 3.8.3 - Arbitrary File Access

This plugin is prone to an arbitrary file access in gallery-plugin.php filename1 parameter. It allows attackers to read arbitrary files. Solution Upgrade plugin...

WordPress Photo Gallery Plugin Arbitrary File Upload Vulnerability

WordPress Photo Gallery Plugin is a wordpress image plugin. The WordPress Photo Gallery Plugin suffers from an arbitrary file upload vulnerability, which allows attackers to exploit the vulnerability to submit a special file and execute it with WEB privileges, as the program fails to properly...

Sql injection

SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the ascordesc parameter in a create gallery request in the galleriesbwg page to wp-admin/admin.php...

CVE-2015-1393

The CVE-2015-1393 entry concerns the Photo Gallery WordPress plugin (before 1.2.11). The vulnerability is a SQL injection in the asc_or_desc parameter of a create gallery request processed via galleries_bwg on wp-admin/admin.php, exploitable by remote authenticated users. The affected component i...

WordPress Plugin Photo Gallery Has Multiple Cross-Site Scripting Vulnerabilities

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress plugin Photo Gallery has multiple cross-site scripting vulnerabilities due to the program failing to properly filte...

Photo Gallery <= 1.2.8 - Multiple Authenticated Reflected XSS

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by a Multiple Authenticated Reflected XSS security vulnerability. PoC /wp-admin/admin-ajax.php?action=addImages=700=550=jpg,jpeg,png,gif=bwgaddpreviewimageby=name";...

CVE-2015-1055

The CVE-2015-1055 vulnerability affects the WordPress Photo Gallery plugin (version 1.2.7 and earlier) used with WordPress. It allows remote attackers to perform a blind SQL injection via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php, potentially exposing or altering da...

WordPress Plugin Photo Gallery 'wp-admin/admin-ajax.php' SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Photo Gallery 'wp-admin/admin-ajax.php'. Due to the program...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct cross-site scripting XSS attacks via...

CVE-2014-7153

SQL injection vulnerability in the editgallery function in admin/galleryfunc.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php...

CVE-2014-7153

The CVE-2014-7153 affects the WordPress Huge-IT Image Gallery plugin (version 1.0.1) via a SQL injection in admin/gallery_func.php: editgallery, exploitable by remote authenticated users through the removeslide parameter to wp-admin/admin.php. Root cause is unsafe SQL construction in the removesl...

WordPress Huge IT Image Gallery Plugin 1.0.1 - Authenticated SQL Injection

An authenticated SQL injection allows an attacker to bypass a web application’s authentication mechanism and retrieve the contents of database. Solution Upgrade the plugin...

Post Gallery - Cross-Site Scripting (XSS)

The post-gallery WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

NextGEN Gallery 2.0.0 - Directory Traversal

The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a Directory Traversal security vulnerability...

NextGEN Gallery - swfupload.swf Cross-Site Scripting (XSS)

The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a swfupload.swf Cross-Site Scripting XSS security vulnerability...