WordPress Plugin Photo Gallery Has Multiple Cross-Site Scripting Vulnerabilities

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress plugin Photo Gallery has multiple cross-site scripting vulnerabilities due to the program failing to properly filte...

Photo Gallery <= 1.2.8 - Multiple Authenticated Reflected XSS

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by a Multiple Authenticated Reflected XSS security vulnerability. PoC /wp-admin/admin-ajax.php?action=addImages=700=550=jpg,jpeg,png,gif=bwgaddpreviewimageby=name";...

CVE-2015-1055

The CVE-2015-1055 vulnerability affects the WordPress Photo Gallery plugin (version 1.2.7 and earlier) used with WordPress. It allows remote attackers to perform a blind SQL injection via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php, potentially exposing or altering da...

WordPress Plugin Photo Gallery 'wp-admin/admin-ajax.php' SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Photo Gallery 'wp-admin/admin-ajax.php'. Due to the program...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct cross-site scripting XSS attacks via...

CVE-2014-7153

SQL injection vulnerability in the editgallery function in admin/galleryfunc.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php...

CVE-2014-7153

The CVE-2014-7153 affects the WordPress Huge-IT Image Gallery plugin (version 1.0.1) via a SQL injection in admin/gallery_func.php: editgallery, exploitable by remote authenticated users through the removeslide parameter to wp-admin/admin.php. Root cause is unsafe SQL construction in the removesl...

WordPress Huge IT Image Gallery Plugin 1.0.1 - Authenticated SQL Injection

An authenticated SQL injection allows an attacker to bypass a web application’s authentication mechanism and retrieve the contents of database. Solution Upgrade the plugin...

Post Gallery - Cross-Site Scripting (XSS)

The post-gallery WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

NextGEN Gallery 2.0.0 - Directory Traversal

The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a Directory Traversal security vulnerability...

NextGEN Gallery - swfupload.swf Cross-Site Scripting (XSS)

The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a swfupload.swf Cross-Site Scripting XSS security vulnerability...

WP Easy Gallery 2.7 - admin/add-images.php Multiple Parameter SQL Injection

The WP Easy Gallery – WordPress Gallery Plugin WordPress plugin was affected by an admin/add-images.php Multiple Parameter SQL Injection security vulnerability...

WordPress Lazyest Gallery Plugin <= 0.10.4.3 - Content Manipulation

This plugin is prone to multiple file/directory insecure permissions local content manipulation. Solution Update the plugin...

WordPress Video Gallery Plugin 2.5 - Multiple Vulnerabilities

Video Gallery plugin is prone to multiple vulnerabilities, such as SQL injection and XSS vulnerabilities. Solution Upgrade the plugin...

Wordpress Gallery Plugin 3.06 Arbitrary File Upload

No description provided by source. Description : Wordpress Plugins - Gallery Arbitrary File Upload Vulnerability Version : 3.06 Link : http://wordpress.org/extend/plugins/gallery-plugin/ Plugins : http://downloads.wordpress.org/plugin/gallery-plugin.3.06.zip Date : 01-06-2012 Google Dork :...

WordPress Ajax Gallery plugin <= 3.0 - SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Ajax Gallery plugin = 3.0 SQL Injection Vulnerability Date: 2011-08-18 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/ajaxgallery.3.0.zip Version: 3.0 tested --- PoC --...

Wordpress TimThumb 2.8.13 WebShot - Remote Code Execution Exploit

Exploit for php platform in category web applications | | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Wordpress TimThumb 2.8.13 WebShot Remote Code Execution 0-day Affected website : a lot Wordpress Themes, Plugins, 3rd party components...

Multiple WordPress Plugins (TimThumb 2.8.13 / WordThumb 1.07) - 'WebShot' Remote Code Execution

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Wordpress TimThumb 2.8.13 WebShot Remote Code Execution 0-day Affected website : a lot Wordpress Themes, Plugins, 3rd party components Exploit Author : @u0x Pichaya Morimoto Release dates :...

CVE-2014-2558

The CVE-2014-2558 entry concerns the WordPress File Gallery plugin (versions before 1.7.9.2). The vulnerability stems from improper escaping in the Settings Page that allows a remote attacker to trigger arbitrary PHP code execution via a backslash-quote in fields referencing /wp-admin/options-med...

CVE-2014-2333

Cross-site scripting XSS vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information...