PT-2024-18404 · WordPress · The Grid Gallery

Name of the Vulnerable Software and Affected Versions: The Grid Gallery – Photo Image Grid Gallery plugin for WordPress versions up to, and including, 1.4.3 Description: The issue allows authenticated attackers with contributor access and above to inject a PHP Object via deserialization of...

CVE-2024-1897: Deserialization of Untrusted Data

The Grid Gallery – Photo Image Grid Gallery plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization via shortcode of untrusted input from the awlggsettings meta value. This makes it possible for authenticated attackers, with...

PT-2021-16051

Name of the Vulnerable Software and Affected Versions The Grid Gallery – Photo Image Grid Gallery WordPress plugin versions prior to 1.2.5 Description The issue arises from the improper sanitization of the title field for image galleries when added via the admin dashboard, resulting in an...

CVE-2021-24529: Improper Neutralization of Input During Web Page Generation

The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability...