CVE-2024-13584

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperpictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplie...

CVE-2024-13584 Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperpictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplie...

CVE-2024-13584: Improper Neutralization of Input During Web Page Generation

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisperpictures' shortcode in all versions up to, and including, 1.5.19 due to insufficient input sanitization and output escaping on user supplie...

WordPress plugin Picture Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

WordPress Picture Gallery plugin <= 1.5.19 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Picture Gallery versions = 1.5.19...

CVE-2024-12696 Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via videowhisper_picture_upload_guest Shortcode

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisperpictureuploadguest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user...

PT-2025-1927 · WordPress · The Picture Gallery – Frontend Image Uploads

Name of the Vulnerable Software and Affected Versions: The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress versions up to, and including, 1.5.22 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escapi...

CVE-2024-12696: Improper Neutralization of Input During Web Page Generation

The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's videowhisperpictureuploadguest shortcode in all versions up to, and including, 1.5.22 due to insufficient input sanitization and output escaping on user...

WordPress plugin Picture Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

WordPress Picture Gallery plugin <= 1.5.22 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by SOPROBRO in WordPress Plugin Picture Gallery versions = 1.5.22...

Plane 跨站脚本漏洞

Plane is an open source, self-hosted project planning tool from Plane Open Source. A cross-site scripting vulnerability exists in Plane versions prior to 0.23, which stems from the presence of a cross-site scripting XSS vulnerability that allows an authenticated user to upload an SVG file...

Campcodes Project Management System 代码问题漏洞

Campcodes Project Management System is a project management system from Campcodes, Inc. A code issue vulnerability exists in Campcodes Project Management System version 1.0, which stems from the parameter file in the file /forms/updateforms.php?action=changepic2&id=4 that can lead to unrestricted...

PT-2025-32247

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 139.0.7258.66 Description An inappropriate implementation in Picture In Picture functionality allowed a remote attacker to perform UI spoofing. The attacker could convince a user to engage in specific UI gesture...

The vulnerability of the console-based MPEG audio player mpg123, related to the ability to write beyond the allocated memory, allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the console-based MPEG audio player mpg123 lies in its ability to write beyond the allocated memory boundaries. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause system failures...

gstreamer1-plugins-good: OOB-write in isomp4/qtdemux.c

A flaw was found in the GStreamer library. An integer overflow in the MP4/MOV demuxer's sample table parser can lead to out-of-bounds writes and NULL-pointer dereferences for certain input files. This vulnerability allows a malicious third party to trigger an application crash and, in the case of...

PT-2025-32245

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 139.0.7258.66 Description An inappropriate implementation in Picture in Picture functionality allowed a remote attacker to perform UI spoofing. The attacker could convince a user to engage in specific UI gesture...

CVE-2024-12042

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for...

CVE-2024-12042

CVE-2024-12042 is an authenticated Stored Cross-Site Scripting vulnerability in the MStore API – Create Native Android & iOS Apps On The Cloud WordPress plugin (

PT-2024-17416 · WordPress · Mstore Api

Name of the Vulnerable Software and Affected Versions: MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress versions up to, and including, 4.16.4 Description: The issue is related to Stored Cross-Site Scripting via the profile picture upload functionality due to...

CVE-2024-12042: Unrestricted Upload of File with Dangerous Type

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for...