WordPress Sunshine Photo Cart plugin < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure vulnerability

Unauthenticated Private Gallery Comment Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.6.12...

Photo Gallery by 10Web < 1.6.0 - SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection id:...

NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure

The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getitem function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data includi...

CVE-2026-73184

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

CVE-2026-61986

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

EUVD-2026-62379

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

CVE-2026-73184

The WordPress Global Gallery plugin (versions ≤ 11.1.2) contains an unauthenticated reflected/stored XSS vulnerability exploitable via a crafted URL; no specific vulnerable file or root cause is documented. CVSS 3.1 scores it HIGH (7.1) with network attack vector and no authentication required. P...

CVE-2026-73184 WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

CVE-2026-61986

CVE-2026-61986 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Contest Gallery plugin , affecting versions 30.0.5 and earlier . The flaw allows an unauthenticated attacker to inject malicious scripts, with a CVSS 3.1 base score of 7.1 (HIGH) — network vector, low c...

CVE-2026-61986 WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

EUVD-2026-62373

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Global Gallery versions = 11.1.2...

WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Thaer Assfour in WordPress Plugin Contest Gallery versions = 30.0.5...

PT-2026-78335

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

WordPress Contest Gallery plugin <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId' vulnerability

Authenticated Author+ Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cgmultiplefilesforpost' - 'cgRealId' vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Contest Gallery versions = 30.0.7...

CVE-2026-49301

Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-49301

Technical details beyond the basic description are not publicly available in the provided documents. Monitor for updates from Huawei CVE coverage and the CVE/CVE-List records.

EUVD-2026-60075

Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-49301

Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-2497

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...