PT-2025-7885 · Unknown · Simple Photo Feed

Name of the Vulnerable Software and Affected Versions: Simple Photo Feed versions 1.4.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation due to incorrectly configured access control security levels. Recommendations: For Simple Photo...

WordPress plugin Simple Photo Feed 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-7812 · WordPress · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 3.59.9 Description: The issue concerns the Photo Gallery, Sliders, Proofing and WordPress plugin, where some of its image settings are not properly sanitized and...

CVE-2025-27276

Cross-Site Request Forgery CSRF vulnerability in lizeipe Photo Gallery Responsive photo-gallery-pearlbells allows Privilege Escalation.This issue affects Photo Gallery Responsive : from n/a through = 4.0...

WordPress Photo Gallery ( Responsive ) plugin <= 4.0 - CSRF to Privilege Escalation vulnerability

CSRF to Privilege Escalation vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Photo Gallery Responsive versions = 4.0...

CVE-2025-27276

CVE-2025-27276: Photo Gallery ( Responsive ) plugin for WordPress is affected by a CSRF to Privilege Escalation flaw in versions prior to 4.0. Connected sources corroborate that Photo Gallery ( Responsive )

CVE-2025-27276 WordPress Photo Gallery ( Responsive ) plugin <= 4.0 - CSRF to Privilege Escalation vulnerability

Cross-Site Request Forgery CSRF vulnerability in lizeipe Photo Gallery Responsive photo-gallery-pearlbells allows Privilege Escalation.This issue affects Photo Gallery Responsive : from n/a through = 4.0...

CVE-2025-27276 WordPress Photo Gallery ( Responsive ) plugin <= 4.0 - CSRF to Privilege Escalation vulnerability

Cross-Site Request Forgery CSRF vulnerability in lizeipe Photo Gallery Responsive photo-gallery-pearlbells allows Privilege Escalation.This issue affects Photo Gallery Responsive : from n/a through = 4.0...

CVE-2024-13822

The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13822

The Photo Contest | Competition | Video Contest WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13822

The CVE-2024-13822 entry concerns the WordPress plugin Total Contest Lite (Photo Contest | Competition | Video Contest) up to version 2.8.1, which outputs an unsanitized parameter, enabling a Reflected XSS. Connected sources corroborate a reflected-XSS issue in Total Contest Lite (versions ≤ 2.8....

PT-2025-7723 · Unknown · Photo Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery Responsive versions prior to 4.0 Description: A Cross-Site Request Forgery CSRF issue allows Privilege Escalation. This issue enables an attacker to perform actions on behalf of another user without their knowledge or consent...

PT-2025-7704 · WordPress · The Photo Contest | Competition | Video Contest

Name of the Vulnerable Software and Affected Versions: The Photo Contest | Competition | Video Contest WordPress plugin versions 2.8.1 and earlier Description: The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users such as admin. This occurs becau...

WordPress plugin Photo Gallery ( Responsive ) 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2025-7660 · Sourcecodester · Sourcecodester Best Church Management

Name of the Vulnerable Software and Affected Versions: SourceCodester Best Church Management Software version 1.0 Description: A critical vulnerability was found in the software, affecting an unknown functionality of the file /admin/app/asset crud.php. The manipulation of the photo1 argument lead...

CVE-2024-13873

WP Job Portal for WordPress (plugin) is vulnerable up to version 2.2.8. An Insecure Direct Object Reference exists in deleteUserPhoto() due to missing validation of a user-controlled key, enabling authenticated users with Subscriber+ rights to remove profile photos from other user accounts. The i...

CVE-2024-13873 WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.8 via the deleteUserPhoto function due to missing validation on a user controlled key. This makes it...

CVE-2024-13873 WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.8 via the deleteUserPhoto function due to missing validation on a user controlled key. This makes it...

WordPress WP Job Portal plugin <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ User Photo Disconnection vulnerability discovered by thevietronin in WordPress Plugin WP Job Portal versions = 2.2.8...

CVE-2024-13751

The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and...