14137 matches found
CVE-2026-19430 CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...
PT-2026-83401
Name of the Vulnerable Software and Affected Versions Catfolders Document Gallery Pro versions prior to 2.0.7 Description Certain REST API routes lack proper authorization, and the token used to identify requested content can be forged on the client side. This allows unauthenticated users to list...
CVE-2026-19430: Missing Authorization
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the...
EUVD-2026-66296
A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...
CVE-2026-3423
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-3423 Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EUVD-2026-67708
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-3423 Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-3423
The Envira Gallery WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the gallery description configuration field in all versions up to and including 1.12.4 . The root cause is insufficient input sanitization and output escaping , allowing authenticated attackers with Author-...
CVE-2026-78238
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
WordPress Envira Gallery plugin <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description vulnerability
Authenticated Author+ Stored Cross-Site Scripting via Gallery Description vulnerability discovered by lord willmore - self in WordPress Plugin Envira Photo Gallery versions = 1.12.4...
CVE-2026-78238
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
CVE-2026-78238
SOY Gallery is affected by a cross-site scripting (XSS) vulnerability that allows arbitrary script execution in the web browser of a user who is logging in to the product. The vulnerability requires low privileges and active user interaction , with impact on subsequent system confidentiality and ...
EUVD-2026-67578
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
PT-2026-83122
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-78238: Improper Neutralization of Input During Web Page Generation
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
PT-2026-82885
SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...
CVE-2026-3423: Improper Neutralization of Input During Web Page Generation
The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and including, 1.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress All-in-One Video Gallery plugin < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter vulnerability
Subscriber+ Server-Side Request Forgery via 'vdl' Parameter vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin All-in-One Video Gallery versions 4.9.2...