CVE-2025-12849

The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the cgcheckwpadminuploadv10 AJAX action for both authenticated and unauthenticated users without implementing capability checks or non...

WordPress WP Easy Gallery plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation vulnerability

Missing Authorization to Authenticated Subscriber+ Gallery Manipulation vulnerability discovered by Lucio Sá in WordPress Plugin WP Easy Gallery versions = 4.8.5...