CVE-2026-111971 Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site...

CVE-2026-111971

The Photo Engine (Media Organizer & Lightroom) WordPress plugin, in versions prior to 6.5.8 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape collection and gallery names before they are stored and subsequently rendered within an ...

CVE-2025-15524

CVE-2025-15524 affects the WordPress plugin Gallery by FooGallery (versions up to and including 3.1.9). A missing capability check in ajax_get_gallery_info() allows authenticated users with Subscriber-level access and above to enumerate gallery IDs and retrieve private/draft/password-protected ga...

CVE-2024-26491

A cross-site scripting XSS vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field...

CVE-2024-27757

flusity CMS through 2.45 allows tools/addonsmodel.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024."...

CVE-2024-27757

flusity CMS through 2.45 allows tools/addonsmodel.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024."...

CVE-2024-27757

flusity CMS through 2.45 allows tools/addonsmodel.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024."...

CVE-2024-27757

flusity CMS through 2.45 allows tools/addonsmodel.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024."...

CVE-2024-27757: Improper Neutralization of Input During Web Page Generation

flusity CMS through 2.45 allows tools/addonsmodel.php Gallery Name XSS. The reporter indicates that this product "ceased its development as of February 2024."...

PT-2024-22025 · Unknown · Flusity-Cms

Name of the Vulnerable Software and Affected Versions: flusity CMS versions through 2.45 Description: The issue allows for XSS in the Gallery Name through the tools/addons model.php file. The product has ceased its development as of February 2024. Recommendations: For versions through 2.45, as a...

CVE-2024-26491

A cross-site scripting XSS vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field...

CVE-2024-26491

A cross-site scripting XSS vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field...

CVE-2024-26491

A cross-site scripting XSS vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field...

CVE-2024-26491: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field...

PT-2024-21405

Name of the Vulnerable Software and Affected Versions flusity-CMS version 2.33 Description A cross-site scripting XSS issue in the Addon JD Flusity 'Media Gallery with description' module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery nam...

PT-2022-28074 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: FlatPress affected versions not specified Description: A problematic issue was found in FlatPress, affecting the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the Media Manager Plugin. The manipulatio...

CVE-2016-10889

The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name...

Sql injection

The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name...

PT-2019-7685

Name of the Vulnerable Software and Affected Versions nextgen-gallery plugin versions prior to 2.1.57 Description The issue is related to SQL injection, which can occur via a gallery name. Recommendations For versions prior to 2.1.57, update to version 2.1.57 or later to resolve the issue...

CVE-2016-10889: Improper Neutralization of Special Elements used in an SQL Command

The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name...