PT-2026-95255

Name of the Vulnerable Software and Affected Versions Filter Gallery versions prior to 1.1.5 Description The plugin fails to verify the nonce a unique token used to prevent cross-site request forgery on several AJAX handlers when the nonce field is omitted. Additionally, it lacks capability check...

CVE-2026-90978: Improper Access Control

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

CVE-2026-6566: Authorization Bypass Through User-Controlled Key

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for...

CVE-2025-14455

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible fo...

EUVD-2025-204522

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.7. This is due to the plugin not properly verifying that a user is authorized to perform actions on gallery management functions. This makes it possible fo...

SourceCodester Online Hotel Reservation System 注入漏洞

SourceCodester Online Hotel Reservation System is a SourceCodester open source online hotel system. An injection vulnerability exists in SourceCodester Online Hotel Reservation System version 1.0, which originates from SQL injection due to incorrect manipulation of the parameter ID in the file...

CVE-2021-24795

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery CSRF check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery...

PT-2021-16290

Name of the Vulnerable Software and Affected Versions: Filter Portfolio Gallery WordPress plugin versions 1.5 and earlier Description: The issue is related to a lack of Cross-Site Request Forgery CSRF check when deleting a Gallery. This could allow attackers to make a logged-in admin delete...

CVE-2021-24795: Cross-Site Request Forgery (CSRF)

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery CSRF check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery...