87 matches found
CVE-2024-13714 All-Images.ai – IA Image Bank and Custom Image creation <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload
The All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'getimagebyurl' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with...
PT-2025-6446 · WordPress · All-Images.Ai
Name of the Vulnerable Software and Affected Versions: All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is related to arbitrary file uploads due to missing file type validation in the get image by url function...
CVE-2024-0869
The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the instant-images/license...
PT-2025-2223 · WordPress · The Picture Gallery – Frontend Image Uploads
Name of the Vulnerable Software and Affected Versions: Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress versions up to, and including, 1.5.19 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'videowhisper pictures' shortcode due to...
CVE-2024-5945
The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization. This makes it possible for authenticated attackers, with Author-level access and above, who have permissio...
WordPress WP SVG Images plugin <= 4.2 - Authenticated Stored Cross-Site Scripting via SVG vulnerability
Authenticated Stored Cross-Site Scripting via SVG vulnerability discovered by Colin Xu in WordPress Plugin WP SVG images versions = 4.2...
WordPress Instant Images plugin <= 6.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability
Arbitrary Option Update to Privilege Escalation vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Instant Images versions = 6.1.0...
CVE-2024-31093 WordPress Broken Images plugin <= 0.2 - CSRF to XSS vulnerability
Cross-Site Request Forgery CSRF vulnerability in Kaloyan K. Tsvetkov Broken Images allows Cross-Site Scripting XSS.This issue affects Broken Images: from n/a through 0.2...
WordPress Broken Images Plugin <= 0.2 is vulnerable to Cross Site Request Forgery (CSRF)
Software Broken Images Type Plugin Vulnerable versions = 0.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31093 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID cb4b7a81c1eb Credits Dimas Maulana Required...
CVE-2024-0869
The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the instant-images/license...
CVE-2023-27451
Server-Side Request Forgery SSRF vulnerability in Darren Cooney Instant Images plugin = 5.1.0.2 versions...
CVE-2023-28173
Cross-Site Request Forgery CSRF vulnerability in Amit Agarwal Google XML Sitemap for Images plugin = 2.1.3 versions...
CVE-2023-28173
Cross-Site Request Forgery CSRF vulnerability in Amit Agarwal Google XML Sitemap for Images plugin = 2.1.3 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Amit Agarwal Google XML Sitemap for Images plugin = 2.1.3 versions...
CVE-2023-28173
CVE-2023-28173 describes a Cross-Site Request Forgery (CSRF) in the Google XML Sitemap for Images WordPress plugin, affected versions ≤ 2.1.3. The issue is unauthenticated, enabling CSRF actions on sites where a user is logged in. Public disclosures in PatchStack/Red Hat/NVD entries confirm the v...
WordPress Custom Header Images Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Custom Header Images Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-46636 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d852d829fc53 Credits Nguyen Xuan Chie...
CVE-2023-40671
CVE-2023-40671 concerns the WordPress plugin DX-auto-save-images (vulnerable
CVE-2023-36693
Cross-Site Request Forgery CSRF vulnerability in Alain Gonzalez WP RSS Images plugin = 1.1 versions...
CVE-2022-46866 WordPress Import External Images Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Marty Thornley Import External Images plugin = 1.4 versions...